up vote 0 down vote favorite
share [g+] share [fb]

I've been using tshark recently and I've noticed that on certain urls it truncates the URL:

Request URI [truncated]: /2577439/300x250_062810_CLICK_AND_SAVE.swf?clickTag=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/39ff/f/ae/%252a/q%253B226360793%253B0-0%253B0%253B51838704%253B4307-300/250%253B37360783/37378661/1%253B%253B%257Eo

For reference the real URL is here.

Is there anyway (besides using the -w option to have it not truncate my urls? I don't want to use -w as then I have to reconstruct the tcp packets by hand.

Edit: I am using -V to produce this output and I've tried -s0 which does not solve this.

link|improve this question
100% accept rate
feedback

1 Answer

up vote 1 down vote accepted

-T pdml or -T text both look like they output the non-truncated URL, even though -T pdml says it's truncated, it doesn't actually appear to be truncated.

Better yet, if you only want a subset of the fields, look at -e. For example, if you only cared about the URI, try

sudo tshark -e http.request.uri -T fields tcp port 80

...which outputs just the URI. You can even use -E to specify how those fields are formatted in the output, for example to make it easier to parse from a script.

link|improve this answer
I want the full HTTP headers, but I'm currently using the functionality of -V for other information. Fields only give me a subset of all HTTP headers. Finally, -T text didn't give me the full URL, but -T pdml may have. I have to check a few urls to be sure. – tzenes Aug 24 '10 at 16:04
I can confirm that pdml does give the full (not truncated, despite saying otherwise) uri in the field name="http.request.uri" though not in the field that shows the GET+uri. I've rewritten my code to work with that and marking this as the answer. – tzenes Aug 24 '10 at 17:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.