On Fri, 29 May 2009 22:21:59 -0400 wireshark wrote
Hi Wireshark:)
>I would like to extract the HTML payload from a packet.
>when I do a tshark -V on a captured file it shows all the details including
>a section called:
>
>Line-based text data: text/html
>that contains all that I need to extract.
Line-based text data: text/html
=> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"\n
=> \t"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>\n
=> this is a Text item()
A Text item() is not a fieldname, so you can not filter on that.
>
>however, when I do: tshark -T fields -e data-text-lines
>
>I only get back: Line-based text data: text/html
>
>What am I doing wrong ?
Maybe Wireshark can help a bit:
Apply a display filter: data-text-lines
Expand only "Line-based text data" in Packet Details.
File -> Export -> File
Packet Range: Displayed
Packet Format: Packet Details -> As displayed
Save as plain text.
HTH
Joan
