Re: question about exporting/filtering files

[Richard Bejtlich <taosecurity () gmail com>]

On Wed, Dec 2, 2009 at 1:17 PM, Gerald Combs <gerald () wireshark org> wrote:

> You should be able to post-process the capture files using tshark and a
> display filter, e.g.
>
> for capfile in *.pcap ; do
>    tshark -r $capfile -R 'http.request.method == "GET"' \
>        -w get-only-$capfile
> done
>
> If you want to filter on GET requests at capture time you could use
> something like Jefferson Ogata's Big Hairy HTTP GET Filter:
>
>    tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420

Hi Gerald,

Any rationale for why the display filter can be used to limit -w to
only the packet of interest when used with -r , but not when doing
live capture?

Thank you,

Richard
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe