I routinely have large pcap files that I need to export the HTTP objects from. How can I do this via command line? Using the GUI is a very slow process with large files. asked 28 Aug '14, 10:41  stom edited 28 Aug '14, 10:41 |
2 Answers:
Please see my answers to similar questions:
Regards answered 31 Aug '14, 04:28  Kurt Knochner ♦ |
As of Wireshark 2.3.0, you can export HTTP objects with tshark. (Wireshark 2.3.0 hasn't been released yet, so you can grab a daily build from here.) To extract HTTP objects from the command-line, run the following command: answered 15 Dec '16, 16:52  moshe |
see this: https://ask.wireshark.org/questions/35689/export-http-packet-from-pcap-file
I'm actually looking to export the object themselves to a folder, not just have them placed into another PCAP that I'll then still have to open and manually export them from. Any way to do this? The proposed solution might make the files smaller and easier to deal with but still isn't the automation I was looking for.