I am running CentOS v5.8 64bit. What are the correct capture and display filters to use in TShark to monitor and trace HTTP/HTTPS traffic similar to what is provided by HTTPWatch? Also, what is the safest value to use for snaplen if I only want the following information below:
Thank you in advance. asked 06 Aug '12, 17:27  bintut |
One Answer:
The safest snaplength to use would be 0 (to capture whole frames), as the URL might be very long and not fit within one packet. So you might need TCP reassembly and that only works when whole frames are captured. The for the correct display and capture filters, HTTP watch is a different tool and it works differently. If all your HTTP traffic is on port 80, you can use the capture filter "tcp port 80". But of course it will give you the whole TCP session, including acks etc. If you just want to see the http-requests and responses, you can use the display filter "http.request or http.response" after capturing. answered 12 Aug '12, 05:34  SYN-bit ♦♦ |
Thank you for your answer. I just created a new question which is not specific to HTTP or HTTPS and you can find it at http://ask.wireshark.org/questions/13898/tshark-display-filter-and-statistics.