How to combine 2 filters to get HTTP GET and POST in the same command? I have tried but result have been only the first filter part. HTTP GET Capture filter sudo tshark -i p2p3 'port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420)' HTTP POST Capture filter sudo tshark -i p2p3 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' Or is there a way to filter out picture and video content since this is the source of the problem? asked 28 Oct '15, 07:36  jmh64swe |
One Answer:
You can set the answered 09 Nov '15, 08:10  grahamb ♦ |
What was the combined filter that you tried? If the two filters each worked separately, you should be able to combine them with a logical 'or'.
Now I tested tshark -i p2p3 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' or 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' but this only gives the last filter in the output.
Any comment?
Is there other ways to discard the actual picture/video content?