Home / server / Questions / 897336
Accepted
pkaeding
Asked: 2018-02-15 22:00:24 +0800 CST

How can I export more than 1000 http request bodies from a large pcap file?

  • 772

I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be flexible on that.

I found something promising in tshark, as this command does almost what I need:

tshark -r capture.pcap --export-objects "http,data"

I get a folder with a bunch of files in it, each one containing one request body.

However, it only outputs the first 1000 requests. How can I get the rest of the requests?

pcap

1 Answers

  1. Best Answer

    Try running tshark -r events.pcap -Y "http.request" -T fields -e http.file_data.

    -Y "http.request" - filters for packets which are http requests

    -T fields -e http.file_data - sets the output fields to just the request body

    EDIT: With a large file, you may need to split up your captures with a tool like editcap.

    • 2