Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?
Not practical with Wireshark but have a look at this: http://chaosreader.sourceforge.net/
I don't think the reports are in w3c extended log format but...why so strict? Surely a bit a perl will let you munge them into w3c extended log format.
See http://isc.sans.edu/diary.html?storyid=6961 for more leads.