13

I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get).

I tried using:

tshark tcp port 80 or tcp port 443 -V -R "http"

Which gave me the header, but also content (which I don't want as its a large amount of garbage to parse). I really only care about the header, is there any easy way to get just that (other than parsing the data myself).

Edit: I should qualify I also care about host/port so I can keep track of requests across multiple packets.

4 Answers 4

21

You can use the specific HTTP header display filters to show either just the request headers, just the response headers or both.

For just the request headers:

tshark tcp port 80 or tcp port 443 -V -R "http.request"

For just the response headers:

tshark tcp port 80 or tcp port 443 -V -R "http.response"

And for both the request and response headers:

tshark tcp port 80 or tcp port 443 -V -R "http.request || http.response"

Note: This does not filter out just the headers, just the packets that contain the headers, so you will likely still get some data, but the amount of data should be less than you would otherwise.

4
  • We're still talking about a ton of data as if I have a request for en.wikipedia.org I'm getting back 750k when I really only want less than 1k in headers.
    – tzenes
    Aug 19, 2010 at 21:38
  • tshark is a packet capture tool, you may want to look into something like Fiddler or another HTTP-only analysis tool.
    – heavyd
    Aug 19, 2010 at 21:45
  • I'm not familiar with fiddler but my goal is to track connection throughput so I want to know requesttime/firstbyte/lastbyte while retaining HTTP headers. tshark already solve most of my problem, I just need to get the headers.
    – tzenes
    Aug 19, 2010 at 21:49
  • 6
    It produces "tshark: Invalid capture filter" (Tshark 2.0.2). As a workaround, I've used: tshark -V -Y http.request tcp port 80 or tcp port 443
    – jfs
    Jan 8, 2017 at 15:40
6

In fact you can! All previous answers were very close. All you need is -O flag which filters out all the information but HTTP.

tshark -O http -R http.request tcp port 80 or tcp port 443
1
  • 1
    This is the correct answer. May 5, 2017 at 18:43
4

I was able to combine the answer from @heavyd and run it through a sed filter I got from an SO article - (F.J.'s answer) to cook up this baby, which filters out just the headers :)

sudo tshark tcp port 80 or tcp port 443 -V -R "http.request || http.response" | sed -rn '/Hypertext Transfer Protocol/{:a;N;/    \\r\\n:?/{/.*/p;d};ba}' >> /tmp/filtered
1
  • 1
    terrifying sed cause i can't read it but worked like a charm.
    – Setheron
    Mar 22, 2018 at 22:29
2

My own filter version for easy reading:

tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer Protocol/,/Frame/ { print };/Transmission Control Protocol/{print};/Internet Protocol/{print}" | grep -v Frame

This way I see only relevant IP and TCP information, without all the low level stuff, plus the complete HTTP info.

1
  • sudo tshark -V -s0 port 80 -Y "(http.request || http.response)" | awk "/Hypertext Transfer Protocol/,/^$/"
    – Lmwangi
    Nov 24, 2016 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .