I want to get the complete POST request from tshark. I have applied this display filter tshark -r test.pcap -2 -Y "http and http.host==test.com and http.request.method=="POST"" -T text but I didn't get the complete request I only got a small part of the request. In wireshark (GUI) I can see the full request because it is the assembly of 3 packets. Any ideas? PS: I have tried the -2 option too asked 27 Oct '14, 12:51 storm |