Using tshark to save filtered packets to file

I would think there's some way to do that, but I can't seem to find it. For most fields you can get their value using the "-T fields -e [fieldname]" command switch for tshark, but in HTTP the field would be the data-text-lines field, but that will only give you something like "Line-based text data: text/html" instead of the whole content body.

So here's a way to do it using a Lua script - copy/paste the Lua script code at the bottom of this answer into a file, such as extract.lua. Then run tshark in the following way:

# the below is all one line
tshark -r [input_filename] -Y 'http.content_type contains html' -X lua_script:extract.lua
    -X lua_script1:data-text-lines -T fields -e extractor.value.string > output_file.txt

What that will do is read in the file ("[input_filename]"), filter the packets so you only get the ones with content-type html, with the Lua script file named "extract.lua", and pass into the Lua script an argument of "data-text-lines" which the Lua script uses as the field you want to extract. The Lua script will create a new field called "extractor.value.string" of the string contents of the passed-in field "data-text-lines", so the "-T fields -e extractor.value.string" switch tells tshark to print that out. It then saves the output to a file using the "> output_file.txt" .

Here's the Lua script:

-- grab the passed-in argument(s)
local args = { ... }
– exit if no arguments were passed in
if #args == 0 then
return
end
– a table to hold field extractors
local fields = {}
– create field extractor(s) for the passed-in argument(s)
for i, arg in ipairs(args) do
fields[i] = Field.new(arg)
end
– our fake protocol
local exproto = Proto.new("extractor", "Data Extractor")
– the new fields that contain the extracted data (one in string form, one in hex)
local exfield_string = ProtoField.new("Extracted String Value", "extractor.value.string", ftypes.STRING)
local exfield_hex    = ProtoField.new("Extracted Hex Value", "extractor.value.hex", ftypes.STRING)
– register the new fields into our fake protocol
exproto.fields = { exfield_string, exfield_hex }
function exproto.dissector(tvbuf,pktinfo,root)
local tree = nil
for i, field in ipairs(fields) do
    -- extract the field into a table of FieldInfos
    finfos = { field() }

    if #finfos > 0 then
        -- add our proto if we haven't already
        if not tree then
            tree = root:add(exproto)
        end

        for _, finfo in ipairs(finfos) do
            -- get a TvbRange of the FieldInfo
            local ftvbr = finfo.tvb
            tree:add(exfield_string, ftvbr:string(ENC_UTF_8))
            tree:add(exfield_hex,tostring(ftvbr:bytes()))
        end
    end
end

end
register_postdissector(exproto, true)

I have the same issue although I have approached it from a different way. I perform a capture using tshark and within the wireshark dissector, I read the values I want to record, in my case raw and enumerated values using tvb_get_bits8 and similar calls in doc/README.dissectors, then output these values to a data file, in my case, a comma delimited file for later perusal.

So to read these values, I have to step thru the messages thru wireshark. I ensure I do not have duplicate values by maintaining a binary array of sequence numbers so redundant messages aren't output. All sorted by time.

I admit this is a roundabout way of doing this. It works, and it's easy, but it involves stepping thru a lot of message in wireshark to get my data file.