[Richard Bejtlich <taosecurity@xxxxxxxxx>]

On Wed, Dec 2, 2009 at 1:17 PM, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:

> You should be able to post-process the capture files using tshark and a
> display filter, e.g.
>
> for capfile in *.pcap ; do
>    tshark -r $capfile -R 'http.request.method == "GET"' \
>        -w get-only-$capfile
> done
>
> If you want to filter on GET requests at capture time you could use
> something like Jefferson Ogata's Big Hairy HTTP GET Filter:
>
>    tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
>

Hi Gerald,

Any rationale for why the display filter can be used to limit -w to
only the packet of interest when used with -r , but not when doing
live capture?

Thank you,

Richard