The traffic from Wireshark saved into a file with dumpcap. In this file a have for example :

€     X       `þ $À6
@ íëÃNxXÀ¨£ P&E»kKí¨<`PEà;  
HTTP/1.1 200 OK
Cache-Control: private

And I want to see only :

HTTP/1.1 200 OK
Cache-Control: private

      On windows 7 and I use this commands :
      cd wires*
      tshark -D
      dumpcap -i 5 -s 96-w packets.cap

2 Answers 2


The "garbage" prefixing the data you are interested in are the protocol layers (ethernet, ip and transport headers)

When you save the data captured with dumpcap, you are also recording these protocol layers.

To filter them away to only view the TCP data, you need to process your data through a program. Tcpflow is a tool that can extract data from tcp packets.

Take a look at this question, which is essentially the same you are asking.

In your scenario, you would want the command to be something like:

tcpflow -C -r <your-pcap-file>
  • I use this commands: cd\pro* wires* tshark -D dumpcap -i 5 -w packets.cap but I am working on windows in command prompt .What command to use to working tcpflow
    – user50189
    Jul 17, 2014 at 13:06
  • Perhaps "tshark -r infile -T fields -e data"? - ask.wireshark.org/questions/15374/… Jul 17, 2014 at 13:10
  • If I write this I see in command prompt the text in ASCII.If I write tshark -r infile -T fields -e data -w output.raw the file is like infile
    – user50189
    Jul 17, 2014 at 13:26

Are all lines the same as the one in your example?

Assuming this is on a *nix system, you could use grep or awk, or a combination of the two, eg:

cat dumpfile | grep HTTP


cat dumpfile | awk -F; '{print $1}'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .