Tshark Examples

tshark_examples.md

Example 1

Method: POST
Port: 17076
interface: lo

tshark -i lo -Y "http.request.method == POST" -f 'dst port 17076' -T fields -e frame.time -e http.file_data

output

Jan  9, 2020 13:45:51.475342801 UTC {
    "amount": "1",
    "is_send": "true",
    "subtype": "send"
}

Example 2

tshark -i eth0  -Y "http.request.method == POST" -f 'dst port 8669' -T fields -e frame.time -e http.request.method -e http.request.uri

outptut

Jan 20, 2020 08:09:07.251151525 UTC	POST	/logs/transfer
Jan 20, 2020 08:09:07.481379692 UTC	POST	/logs/event