Wireshark-users: [Wireshark-users] Using Tshark to grab ascii only
From: Patrick McCanna <captainmccrank@xxxxxxxxx>
Date: Tue, 20 Jan 2009 22:17:53 -0800
Hi List,

I need to get at the ascii of an http request.  Specifically, I'm trying to grab the data that appears to be stored in the "Line-based text data" field of an http POST request.   I want to build a regular _expression_ to grab only the relevant content, so it's important that I drop the hex information that comes with the -x parameter.

I've tried to use the -T fields -e data-text-lines options, but this only tells me that the data is application/x-www-form-urlencoded.  it does not tell me the actual data stored in the field.

So, my question to the list is this:
Is there a way I can get only the ascii data, or is there some other field I should be specifying so that I can access the information that appears to be stored in the "Line-based text data" information of the POST request from wireshark?

Many thanks!