Is it possible to pass custom HTTP headers fields for HTTP dissection on the CLI with tshark?
I am aware of '-o' to set preferences but the header fields appear to be stored seperately.
asked 04 Nov '10, 04:43
The custom HTTP headers are stored in a user accessible table (UAT) named custom_http_header_fields in your preferences directory. You can fill it in using Wireshark via the HTTP preferences or if you're adventurous you can create it by hand. It should be a CSV file with the field name in the first column and a description in the second column. In either case TShark will use the file.
If your custom_http_header_fields looks like this:
You can do this:
answered 04 Nov '10, 09:06
Gerald Combs ♦♦