This is our old Q&A Site. Please post any new questions and answers at

Hi SYN-bit I posted this question on Jasper suggested I ask you whether you can help here. The question basically is, is it possible to get tshark to emit the content of a (textual) HTTP conversation live, that is not on a set of packets that have already been captured? Thanks! David

asked 27 Jan '13, 11:19

David%20Sackstein's gravatar image

David Sackstein
accept rate: 0%

Nope, I don't think that's (easily) possible. But I'm sure there are other specific http tools that will spit out the http objects for you while receiving them.

permanent link

answered 29 Jan '13, 04:36

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Hi SYN-bit,

I was able to get what I needed in the end, so I will share my findings:

This is the command line I am using:

tshark.exe -i3 -l -f "tcp port 80" -O http -d tcp.port==80,http -o "ip.use_geoip:FALSE" -R "not tcp.analysis.duplicate_ack" -T fields -e -e tcp.port -e http.request.full_uri -e http.request.method -e http.response.code -e http.response.phrase -e http.content_length -e data -e text -E separator=;2>&0

-e data gets me the POST parameters and -e text gets me the content of the response.

permanent link

answered 04 Mar '13, 11:31

David%20Sackstein's gravatar image

David Sackstein
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 27 Jan '13, 11:19

question was seen: 16,634 times

last updated: 04 Mar '13, 11:31

p​o​w​e​r​e​d by O​S​Q​A