This is a static archive of our old Q&A Site. Please post any new questions and answers at

tshark defragmentation with http


I want to get the complete POST request from tshark. I have applied this display filter

tshark -r test.pcap -2 -Y "http and and http.request.method=="POST"" -T text

but I didn't get the complete request I only got a small part of the request.

In wireshark (GUI) I can see the full request because it is the assembly of 3 packets.

Any ideas?

PS: I have tried the -2 option too

asked 27 Oct '14, 12:51

storm's gravatar image

accept rate: 0%