This is our old Q&A Site. Please post any new questions and answers at

Hi guys,

I would like to learn, how to filter multiple whole TCP streams based on inner protocol condition, e.g. HTTP header values.

E.g. I have a capture from a proxy with lot of users, and I want to see only TCP streams which are connecting to The point here is to see the whole TCP stream, not only the frames containing HTTP header with "Host:"

Of course, I can always use "", extract the TCP stream number, and rewrite the filter to "". However, this starts to be a annoying problem, if I have tens or hundreds of connections. It takes lot of time and is not flexible.

In an object language, I would write something like

Thanks in advance!!!


asked 22 Nov '12, 07:48

Jozef's gravatar image

accept rate: 0%

Sad enough conditional filtering is not working in wireshark. What you CAN do to accomplish those tasks where you want to filter based on another filter is to use tshark scripting to do the following:

tshark -r trace.pcap -R "" -n -Tfields -e

` This gives you a list of the stream indexes that match your filter. After that with the use of cli tools like sort,uniq,sed etc. you can in a second step (or all in one) produce a long display filter containing all "or-ed" values you are looking for.


tshark -r trace.pcap -R "" -n -Tfields -e | sort -un | sed ':a;N;$!ba;s/\n/ or'

permanent link

answered 22 Nov '12, 08:06

Landi's gravatar image

accept rate: 28%

Hi Landi,

Thanks. Currently I'm doing it in a very similar way: I use filter, export packet dissections to a text file, and as you said, using grep, awk and sed I prepare a long or-ed list. Not that elegant as with your tshark, however.

Anyway, tshark can save me a minute or so, however it still cuts my thoughts when I'm trying to focus on investigating a problem and I often lose concentration while playing with those filters. I would prefer something quicker. But thanks anyway. Maybe in newer versions there will be conditional filtering or some other sort of backreference.

Thank you.


(22 Nov '12, 13:39) Jozef

You could probably achieve what you want with MATE.

permanent link

answered 26 Nov '12, 12:00

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Nov '12, 07:48

question was seen: 13,417 times

last updated: 26 Nov '12, 12:00

p​o​w​e​r​e​d by O​S​Q​A