Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the Wireshark wiki is an example for filtering HTTP GET requests:

Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP header. "tcp[12:1] & 0xf0) >> 2" figures out the TCP header length. From Jefferson Ogata via the tcpdump-workers mailing list.

with this filter:

port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420

Unfortunately this does not work. How is the correct filter for HTTP GET requests?

share|improve this question
That works for me. At least for outgoing GET requests. – Oliver Salzburg Jun 8 '11 at 12:02
up vote 1 down vote accepted

It does work, make sure you are surrounding your filter in double quotes so the shell doesn't try and parse the filter arguments.

e.g. a curl of for me:

$ sudo tshark -i eth0 "port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  0.000000 -> HTTP GET / HTTP/1.1 

This is a rather complicated way of doing it though. tshark does allow you the concept of applying read filters. Now these may not be as useful if you've got a large volume of data (filtering happens after capturing) but they're certainly more intuitive and readable.

$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  5.641015 -> HTTP GET / HTTP/1.1 
share|improve this answer
thx. I really meant the display filter not the capture filter and didn't find the http.request.method. – cuh Jun 8 '11 at 12:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.