Wireshark-users: [Wireshark-users] tshark - data.text field
From: Jagadeesh Dyaberi <jdyaberi@xxxxxxxxxx>
Date: Wed, 22 Sep 2010 09:10:11 -0700
 Hi,

I need to search through the data packets for 'HTTP' occurrence string(I have URLs embedded in the payload) and am using the following command:
 $ tshark -r trace1.pcap -R 'data.text contains "HTTP"'

but get the following error:
tshark: Neither "data.text" nor "HTTP" are field or protocol names.

I tried byte string matching setting: 'data.data contains 0x68747470' but was unsuccessful.

Any help is appreciated. Thanks