5

I have some .pcap from which I would like to extract all http headers.

By using the filters I'm able to display only Http requests but what I would like is to be able to extract/display/print/export the headers for each requests. Can I do that with Wireshark or should I parse the .pcap file myself ?

Thanks a lot

Improve this question

2 Answers 2

Reset to default
7

I often do that by using either one of two following options:

  1. First option is similar to the one @Elias mentioned earlier, but this is more general, especially when the header field is not visible to select or when you just do not want to look for it in the selected packet.

Go to Edit - Preferences - Appearance - Column, on the right hand side, click '+' button to define your new column. Name your new column (Title), choose Type as "Custom" and enter the Fields you want to get the information of. Below screenshot is what we have with http.host header field.

enter image description here

  1. Second option is to use tshark feature (the tshark.exe file in your Wireshark installtion folder). The below command is to extract the http.host header field from http_only pcap file which we used in first option above.

C:\Program Files\Wireshark>tshark -r http_only.pcapng -T fields -e "http.host" > http_host_only.txt

enter image description here

I hope it is useful.

Improve this answer
5
  • Yes it is. Especially for tshark. However I would like to extract all the http headers (name and maybe value). But I don't know the names..
    – gervais.b
    Sep 4, 2017 at 8:53
  • You can find all http header fields here: wireshark.org/docs/dfref/h/http.html and for other protocols here: wireshark.org/docs/dfref/h/http.html
    – Hung Tran
    Sep 4, 2017 at 10:40
  • Sorry. I mean that I don't know in advance the http headers that are in my requests (the goal is to spot uncommon ones). By using tshark I'm able to produce a text file that contains all requests and headers separated by an empty line. I think that with a little scripting I should be able to convert them to a csv. (Will update this question)
    – gervais.b
    Sep 4, 2017 at 11:04
  • Would look forward to it! And in case your question is answered, please mark the solution ;).
    – Hung Tran
    Sep 4, 2017 at 11:42
  • 1
    Using tshark -r dump.pcap -i http==1 -O http -T fields -e http.request.method -e http.request.uri -e http.request.line > dump.txt I have all http requests and headers in a text file. For each request, I have the ´verb path ,first_header\n` followed by all headers on one line and one empty line between each requests. I made a (Scala) script to transform this text file to a csv that we can import into a spreadsheet. Thanks @Hung Tran
    – gervais.b
    Sep 4, 2017 at 13:30
4

If you have a header visible in a selected packet, right click it and choose apply as column. That will add the data as a column to the packet view. Then you can export your filtered data normally to text or any supported format.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.