Feb 25, 2021

Extracting URL from Pcap

Here's the quick way to extract all the URL from a pcap file using tshark.

$ wget https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap

$ tshark -r smallFlows.pcap -T fields -e http.request.full_uri | grep -v "^$"