This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can i filter browsers for GET / HTTP/1.1? I want to get list of browsers that have been used in capture file. Thanks.

asked 08 Jun '12, 03:51

besomuk's gravatar image

besomuk
1112
accept rate: 0%


Please try this:

tshark -r input.cap -R http.request -T fields -e http.user_agent

and with a filter on HTTP/1.1

tshark.exe -r http_sample.cap -R 'http.request.version eq HTTP/1.1' -T fields -e http.user_agent

HINT: String quoting may be difficult in a Windows DOS box due to the slash ('/')! The DOS shell tries to interpret this as the start of a parameter.

Regards
Kurt

permanent link

answered 08 Jun '12, 03:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 08 Jun '12, 04:34

Hmm...i get only empty list. Here is something else. When i select "GET / HTTP/1.1" within HTTP protocol, and apply filter, i get the list i want. Or at least i think it is complete list.

(08 Jun '12, 04:10) besomuk

I'm sorry, there was a typo in my answer. user-agent (wrong) instead of user_agent (correct)! Please try again.

(08 Jun '12, 04:23) Kurt Knochner ♦

Oh yes, that's it. Thanks.

(08 Jun '12, 04:56) besomuk

Fine.

BTW: I converted your answer to a comment, as that's how this Q&A site works.

(08 Jun '12, 05:11) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×18
×14

question asked: 08 Jun '12, 03:51

question was seen: 17,723 times

last updated: 08 Jun '12, 05:11

p​o​w​e​r​e​d by O​S​Q​A