In the Wireshark wiki is an example for filtering HTTP GET requests:

Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP header. "tcp[12:1] & 0xf0) >> 2" figures out the TCP header length. From Jefferson Ogata via the tcpdump-workers mailing list.

with this filter:

port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420

Unfortunately this does not work. How is the correct filter for HTTP GET requests?

  • That works for me. At least for outgoing GET requests. – Der Hochstapler Jun 8 '11 at 12:02

It does work, make sure you are surrounding your filter in double quotes so the shell doesn't try and parse the filter arguments.

e.g. a curl of google.com for me:

$ sudo tshark -i eth0 "port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  0.000000 -> HTTP GET / HTTP/1.1 

This is a rather complicated way of doing it though. tshark does allow you the concept of applying read filters. Now these may not be as useful if you've got a large volume of data (filtering happens after capturing) but they're certainly more intuitive and readable.

$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  5.641015 -> HTTP GET / HTTP/1.1 
  • thx. I really meant the display filter not the capture filter and didn't find the http.request.method. – cuh Jun 8 '11 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.