Wireshark-users: [Wireshark-users] Using Tshark to grab ascii only
Hi List,
I need to get at the ascii of an http request. Specifically, I'm trying to grab the data that appears to be stored in the "Line-based text data" field of an http POST request. I want to build a regular _expression_ to grab only the relevant content, so it's important that I drop the hex information that comes with the -x parameter.
I've tried to use the -T fields -e data-text-lines options, but this only tells me that the data is application/x-www-form-urlencoded. it does not tell me the actual data stored in the field.
So, my question to the list is this:
Is there a way I can get only the ascii data, or is there some other field I should be specifying so that I can access the information that appears to be stored in the "Line-based text data" information of the POST request from wireshark?
Many thanks!