Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been using tshark recently and I've noticed that on certain urls it truncates the URL:

Request URI [truncated]: /2577439/300x250_062810_CLICK_AND_SAVE.swf?clickTag=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/39ff/f/ae/%252a/q%253B226360793%253B0-0%253B0%253B51838704%253B4307-300/250%253B37360783/37378661/1%253B%253B%257Eo

For reference the real URL is here.

Is there anyway (besides using the -w option to have it not truncate my urls? I don't want to use -w as then I have to reconstruct the tcp packets by hand.


Edit: I am using -V to produce this output and I've tried -s0 which does not solve this.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

-T pdml or -T text both look like they output the non-truncated URL, even though -T pdml says it's truncated, it doesn't actually appear to be truncated.

Better yet, if you only want a subset of the fields, look at -e. For example, if you only cared about the URI, try

sudo tshark -e http.request.uri -T fields tcp port 80

...which outputs just the URI. You can even use -E to specify how those fields are formatted in the output, for example to make it easier to parse from a script.

share|improve this answer
    
I want the full HTTP headers, but I'm currently using the functionality of -V for other information. Fields only give me a subset of all HTTP headers. Finally, -T text didn't give me the full URL, but -T pdml may have. I have to check a few urls to be sure. –  tzenes Aug 24 '10 at 16:04
    
I can confirm that pdml does give the full (not truncated, despite saying otherwise) uri in the field name="http.request.uri" though not in the field that shows the GET+uri. I've rewritten my code to work with that and marking this as the answer. –  tzenes Aug 24 '10 at 17:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.