I often do that by using either one of two following options:
- First option is similar to the one @Elias mentioned earlier, but this is more general, especially when the header field is not visible to select or when you just do not want to look for it in the selected packet.
Go to Edit - Preferences - Appearance - Column, on the right hand side, click '+' button to define your new column. Name your new column (Title), choose Type as "Custom" and enter the Fields you want to get the information of. Below screenshot is what we have with
http.host header field.
- Second option is to use tshark feature (the tshark.exe file in your Wireshark installtion folder). The below command is to extract the
http.host header field from http_only pcap file which we used in first option above.
C:\Program Files\Wireshark>tshark -r http_only.pcapng -T fields -e "http.host" > http_host_only.txt
I hope it is useful.