Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?
Not practical with Wireshark but have a look at this: http://chaosreader.sourceforge.net/
This is a type of "any-snarf" program, as it will fetch ... HTTP transfersfrom the captured data inside network traffic logs. A html index file is created that links to ... reports such as image reports and HTTP GET/POST content reports.
I don't think the reports are in w3c extended log format but...why so strict? Surely a bit a perl will let you munge them into w3c extended log format.
See http://isc.sans.edu/diary.html?storyid=6961 for more leads.