I want to get the complete POST request from tshark. I have applied this display filter
tshark -r test.pcap -2 -Y "http and http.host==test.com and http.request.method=="POST"" -T text
but I didn't get the complete request I only got a small part of the request.
In wireshark (GUI) I can see the full request because it is the assembly of 3 packets.
PS: I have tried the -2 option too
asked 27 Oct '14, 12:51