This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark not displaying http traffic fully

0

I am running tshark command as

tshark  -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: TRUE" -o "ssl.keys_list:192.168.56.101,443,http,/etc/nginx/cert.key" -o "ssl.debug_file:/tmp/ssl.log" tcp port 443  -R "http.response or http.request"

The output is something like this-

  6.183757 192.168.56.101 -> 192.168.56.1 HTTP 1490 HTTP/1.1 200 OK  (application/x-javascript)
  6.329274 192.168.56.101 -> 192.168.56.1 HTTP 960 HTTP/1.1 200 OK  (application/javascript)
  6.475231 192.168.56.101 -> 192.168.56.1 HTTP 1349 HTTP/1.1 200 OK  (PNG)
  6.857929 192.168.56.101 -> 192.168.56.1 HTTP 1444 HTTP/1.1 200 OK  (GIF89a)

How do I go about displaying http form post data? I don't see a relevant field here- https://www.wireshark.org/docs/dfref/h/http.html

asked 22 Oct '14, 15:07

gauravphoenix's gravatar image

gauravphoenix
16226
accept rate: 0%

edited 22 Oct '14, 15:21