This is our old Q&A Site. Please post any new questions and answers at


Is it possible to pass custom HTTP headers fields for HTTP dissection on the CLI with tshark?

I am aware of '-o' to set preferences but the header fields appear to be stored seperately.

Many thanks

asked 04 Nov '10, 04:43

rtector's gravatar image

accept rate: 0%

The custom HTTP headers are stored in a user accessible table (UAT) named custom_http_header_fields in your preferences directory. You can fill it in using Wireshark via the HTTP preferences or if you're adventurous you can create it by hand. It should be a CSV file with the field name in the first column and a description in the second column. In either case TShark will use the file.

If your custom_http_header_fields looks like this:

$ cat ~/.wireshark/custom_http_header_fields 
# This file is automatically generated, DO NOT MODIFY.
"X-Slogan","Site slogan"

You can do this:

$ tshark -r /tmp/ -R http.header.X-Slogan
136 573  11.066907 -> HTTP HTTP/1.1 200 OK  (text/html) 15,7680 507
173 1163  11.147269 -> HTTP HTTP/1.1 200 OK  (text/css) 15,7680 2545
187 654  11.208029 -> HTTP HTTP/1.1 200 OK  (application/x-javascript) 19,9728 2036
193 696  11.219131 -> HTTP HTTP/1.1 200 OK  (PNG) 18,9216 2078
permanent link

answered 04 Nov '10, 09:06

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
accept rate: 24%

Hi Gerald,

Thanks for your answer, I was aware of the way Wireshark stores the custom fields when configured in the GUI.

What I am after however, is a way to specify either a set of custom definitions or a file containing those definitions at the command line as an option to tshark. This would override/supplement the stored preferences, similar to how you can use -o to override the standard preferences.

Any thoughts?


(06 Nov '10, 09:04) rtector
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Nov '10, 04:43

question was seen: 7,174 times

last updated: 06 Nov '10, 09:04

p​o​w​e​r​e​d by O​S​Q​A