Hello I am looking to capture only PUT requests on my web server. I have seen a filter for GET requests and honestly haven't been able to decipher it down so I can adjust it for my need. the filter i found was: tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 and I tried to adjust it to: tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420 which didn't work because I believe the offset is different between GET and PUT requests. ANy help is appreciated. asked 05 Aug '15, 14:06  Deesarmy |
One Answer:
There is a tool to generate capture filters based on strings. PUT /test would translate to: Regards answered 10 Aug '15, 08:04  Kurt Knochner ♦ |
What about this filter:
http.request.method==PUT
Is this you need or do you need something more special?
There is high levels of traffic on this server so I'm trying to build it into a capture filter. The method above would work for display filters which will work but the syntax for capture filtering is a bit different. I appreciate the reaponse though.
Sorry did not read the word capture in your question.