THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 1
Chuckc's avatar
3k
Chuckc
answered 2020-12-06 16:53:27 +0000 
$ tshark -r ./ultpcap2.pcapng -Y "frame contains \"http\""  | wc
    105    1589   16286

$ tshark -r ./ultpcap2.pcapng -Y "tcp contains \"http\""  | wc
     59     802    7940

The search string needs double quotes that are "escaped" since the string passed to -Y also needs quotes.
Brief discussion here in a question about tshark.