This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to filter browsers?

0	How can i filter browsers for GET / HTTP/1.1? I want to get list of browsers that have been used in capture file. Thanks. filter list browser asked 08 Jun '12, 03:51 besomuk 1●1●1●2 accept rate: 0%

One Answer:

Please try this:

tshark -r input.cap -R http.request -T fields -e http.user_agent

and with a filter on HTTP/1.1

tshark.exe -r http_sample.cap -R 'http.request.version eq HTTP/1.1' -T fields -e http.user_agent

HINT: String quoting may be difficult in a Windows DOS box due to the slash ('/')! The DOS shell tries to interpret this as the start of a parameter.

Regards
Kurt

answered 08 Jun '12, 03:58

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 08 Jun '12, 04:34

Hmm...i get only empty list. Here is something else. When i select "GET / HTTP/1.1" within HTTP protocol, and apply filter, i get the list i want. Or at least i think it is complete list.

(08 Jun '12, 04:10) besomuk

I'm sorry, there was a typo in my answer. user-agent (wrong) instead of user_agent (correct)! Please try again.

(08 Jun '12, 04:23) Kurt Knochner ♦

Oh yes, that's it. Thanks.

(08 Jun '12, 04:56) besomuk

Fine.

BTW: I converted your answer to a comment, as that's how this Q&A site works.

(08 Jun '12, 05:11) Kurt Knochner ♦