This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark defragmentation with http

0

I want to get the complete POST request from tshark. I have applied this display filter

tshark -r test.pcap -2 -Y "http and http.host==test.com and http.request.method=="POST"" -T text

but I didn't get the complete request I only got a small part of the request.

In wireshark (GUI) I can see the full request because it is the assembly of 3 packets.

Any ideas?

PS: I have tried the -2 option too

asked 27 Oct '14, 12:51

storm's gravatar image

storm
11112
accept rate: 0%