Tshark one liners

Show uris

tshark -T fields -e http.request.uri | grep -v “^$”

Unique urls

tshark -r sample.pcap -R http.request -T fields -e http.host -e http.request.uri | sort -u

Top ten urls from (http://goo.gl/qd5aI)

tshark -r sample1.cap -R http.request 
-T fields -e http.host -e http.request.uri |
sed -e 's/?.*$//' |
sed -e 's#^\(.*\)\t\(.*\)$#http://\1\2#' |
sort | uniq -c | sort -rn | head

List user agents

sudo tshark -nn -r capture_file.pcap -Tfields -e ip.src -e http.user_agent -R "http.user_agent"

List conversations 

tshark -r sample.pcap  -tad -R"tcp" -o column.format:'"Time","%t", "Source", "%s","Destination", "%d"'


tshark -r samples.cap -q -z conv,tcp

HTTP statistics

tshark -q -z http,stat, -z http,tree -r sample.pcap

DNS

Show responses

tshark -tad -r lupus.pcap -R dns.flags.response==1