How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

Question

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver.

So my plan is to run a test over night (or even weekend), capture the traffic with wireshark and then skim the dumpfiles for damaged responses.

With "http.request.uri matches "^/resource/to/be/tested" display filter I get all wanted requests.

But I need all the responses to these requests - how can I archive this?

Answer 1

You can do it with tshark follow the below steps:

1. Filter all HTTP packets with specific pattern in request uri
2. Follow TCP stream based on src IP, src port, dst IP, dst port

$ tshark -r x.pcap -R 'http.request.uri matches "^/resource/to/be/tested"' \
-T fields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | \
while read line; do 
    tshark -r x.pcap \
    -R "http && ip.addr == `echo $line | awk '{ print $1 }'` && \
    tcp.port == `echo $line | awk '{ print $2 }'` && \
    ip.addr == `echo $line | awk '{ print $3 }'` && \
    tcp.port == `echo $line | awk '{ print $4 }'`" \
    echo
done