How do I return just the Http header from tshark?

Question

I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get).

I tried using:

tshark tcp port 80 or tcp port 443 -V -R "http"

Which gave me the header, but also content (which I don't want as its a large amount of garbage to parse). I really only care about the header, is there any easy way to get just that (other than parsing the data myself).

Edit: I should qualify I also care about host/port so I can keep track of requests across multiple packets.

Answer 1

You can use the specific HTTP header display filters to show either just the request headers, just the response headers or both.

For just the request headers:

tshark tcp port 80 or tcp port 443 -V -R "http.request"

For just the response headers:

tshark tcp port 80 or tcp port 443 -V -R "http.response"

And for both the request and response headers:

tshark tcp port 80 or tcp port 443 -V -R "http.request || http.response"

Note: This does not filter out just the headers, just the packets that contain the headers, so you will likely still get some data, but the amount of data should be less than you would otherwise.