Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using tshark recently and I've noticed that on certain urls it truncates the URL:

Request URI [truncated]: /2577439/300x250_062810_CLICK_AND_SAVE.swf?clickTag=http%3A//

For reference the real URL is here.

Is there anyway (besides using the -w option to have it not truncate my urls? I don't want to use -w as then I have to reconstruct the tcp packets by hand.

Edit: I am using -V to produce this output and I've tried -s0 which does not solve this.

share|improve this question
up vote 1 down vote accepted

-T pdml or -T text both look like they output the non-truncated URL, even though -T pdml says it's truncated, it doesn't actually appear to be truncated.

Better yet, if you only want a subset of the fields, look at -e. For example, if you only cared about the URI, try

sudo tshark -e http.request.uri -T fields tcp port 80

...which outputs just the URI. You can even use -E to specify how those fields are formatted in the output, for example to make it easier to parse from a script.

share|improve this answer
I want the full HTTP headers, but I'm currently using the functionality of -V for other information. Fields only give me a subset of all HTTP headers. Finally, -T text didn't give me the full URL, but -T pdml may have. I have to check a few urls to be sure. – tzenes Aug 24 '10 at 16:04
I can confirm that pdml does give the full (not truncated, despite saying otherwise) uri in the field name="http.request.uri" though not in the field that shows the GET+uri. I've rewritten my code to work with that and marking this as the answer. – tzenes Aug 24 '10 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .