Sample Header Ad - 728x90

TShark pcap filter command possibly simplified?

1 vote
1 answer
395 views
Object: to find the IP addresses of HTTP servers in a pcap file with a specific header string. Can or should the -l option to flush be used? One way: the following was done but am wondering if it can be shortened. If this question is too broad, please advise.
tshark -r file.pcap -T fields -e ip.src -e http.server > name.txt &&
  cat name.txt | sort | uniq -c | sort -nr | grep "xxx_xxx"
Asked by stonetwigger (113 rep)
Oct 9, 2021, 01:03 AM
Last activity: Oct 9, 2021, 05:58 AM