Parse HTTP requests through Wireshark?

Question

Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the (sometimes) truncated URL and find them by myself?

I was using Tamper Data and Firebug, on my Firefox, to analyse these requests, but they're not as reliable as a stand-alone tool for monitoring my network interface, but wireshark keeps data too raw concerning HTTP flow.

If you guys know any other stand-alone tool that does this (must be Linux-compatible), please tell me.

Thanks!

Answer 1

sure, you can do it with tshark:

tshark -n -R http.request -s 2000

If you're running http on a non-standard port, say 8000 for a proxy, make sure to add `-d tcp.port==8000,http' so it will know to decode port 8000 as http traffic.

Answer 2

Have you tried http://www.pcapr.net/xtractr ? It uses tshark to index very large pcaps and has HTTP content extraction

Answer 3

It's not clear what you're ultimately trying to achieve (i.e., what analysis are you trying to do or is this generic troubleshooting, etc).

If you're looking for a realtime HTTP monitor (as you're mooting against pcapr answer), then would just redirecting requests through a proxy do the job (e.g., with Apache or Squid)? Okay, it's not a passive monitor in this instance (unlike wireshark [et al]), but would get you the URLs. Then you should be able to extract the query string from access logs.