Wireshark · Wireshark-users: Re: [Wireshark-users] filter for ONLY initial get request

[Martin Visser <martinvisser99@xxxxxxxxx>]

tcp.stream has been available since 1.2.0 from me recollection.

Regards, Martin

MartinVisser99@xxxxxxxxx

On Sat, Aug 14, 2010 at 8:12 AM, Jeffs <jeffs@xxxxxxxxxxxxx> wrote:

> Any idea on where to start? :-[
>
> I'm not great on bash scripting.  What would be helpful to know is
> this and maybe you could provide me guidance since you understand the
> structure of .cap files better than I do:
>
> Would the flow of the script be to loop through the .cap file pulling
> out data that has GET request and the associated domain, then, while
> in that part of the loop, pull back the http.content_type value, and
> if that value="text/html" output the domain name it just saved, to a
> separate file?
>
> Then move onto the next line?
>
> Do you think that logic would work?

> To be honest, I don't really know the structure of a capture file. My use of Wireshark consists mainly in the use of the GUI (and some other strange things;)  ).
>
> Anyway, what you present doesn't seems illogic to me. I would precise :
> - Filter packets with a filter http.request, displaying the tcp.stream field
> - Iterate through those lines
> - At each line, reload the file using a filter http.content_type=="text/html"&&  tcp.stream==streamid to get the link
>
> But you can also make it by the other direction :
> - Filter using http.content_type=="text/html", displaying the tcp.stream field
> - Iterate and backup every tcp.stream
> - Filter again using http.request, displaying the tcp.stream field
> - Iterate and get every domain corresponding to a tcp.stream that you have previously backed up
> With this logic, you have a great algorithmic gain.
>
> I suggest you to ask your question to the list, not to me directly.
>
> Best regards.
>
I cannot find the _expression_ tcp.stream in the wireshark _expression_ list.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe