Revision history  [back]

If you're only interested in http traffic, then you could try applying a capture file of "tcp port 80", e.g.:

tshark -i eth1 -Y http.request -f "tcp port 80"

And rather than looking at the -a option, you might consider the -b and -w options instead.