1

The traffic from Wireshark saved into a file with dumpcap. In this file a have for example :

€     X       `þ $À6
@ íëÃNxXÀ¨£ P&E»kKí¨<`PEà;  
HTTP/1.1 200 OK
Cache-Control: private

And I want to see only :

HTTP/1.1 200 OK
Cache-Control: private

      On windows 7 and I use this commands :
      cd\pro*
      cd wires*
      tshark -D
      dumpcap -i 5 -s 96-w packets.cap
1

The "garbage" prefixing the data you are interested in are the protocol layers (ethernet, ip and transport headers)

When you save the data captured with dumpcap, you are also recording these protocol layers.

To filter them away to only view the TCP data, you need to process your data through a program. Tcpflow is a tool that can extract data from tcp packets.

Take a look at this question, which is essentially the same you are asking.

In your scenario, you would want the command to be something like:

tcpflow -C -r <your-pcap-file>
| improve this answer | |
  • I use this commands: cd\pro* wires* tshark -D dumpcap -i 5 -w packets.cap but I am working on windows in command prompt .What command to use to working tcpflow – user50189 Jul 17 '14 at 13:06
  • Perhaps "tshark -r infile -T fields -e data"? - ask.wireshark.org/questions/15374/… – Dog eat cat world Jul 17 '14 at 13:10
  • If I write this I see in command prompt the text in ASCII.If I write tshark -r infile -T fields -e data -w output.raw the file is like infile – user50189 Jul 17 '14 at 13:26
-1

Are all lines the same as the one in your example?

Assuming this is on a *nix system, you could use grep or awk, or a combination of the two, eg:

cat dumpfile | grep HTTP

or

cat dumpfile | awk -F; '{print $1}'
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.