tcpdump filter for HTTP GET

[Robert Lowe <Robert.H.Lowe () lawrence edu>]

Hi!

Anyone have a filter that will capture just HTTP GET requests?  I'm looking for
something more specific than just "dst host X and tcp dst port 80", but I'm not
worried about requests to non-standard ports.  I would suspect I could reference
tcp[N:3] = GET, but can N be an expression itself, e.g. the data offset in the
TCP header??

TIA,
Robert


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.