I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get).
I tried using:
tshark tcp port 80 or tcp port 443 -V -R "http"
Which gave me the header, but also content (which I don't want as its a large amount of garbage to parse). I really only care about the header, is there any easy way to get just that (other than parsing the data myself).
Edit: I should qualify I also care about host/port so I can keep track of requests across multiple packets.