tshark http.response_in not working

I have a capture file with a HTTP 1.1 request in frame 536 and the HTTP 200 response in frame 856. Frame 856 is reassembled.
In wireshark 3.6.7 I can filter those two packets by:

http.request_in in{536,856}||http.response_in in{536,856}

or by

http.request_in == 536 || http.response_in == 856

It works fine and i see both packets.

But when I use tshark I only see the response frame 856.

tshark -r tmp.pcap -Y "http.request_in in{536,856} || http.response_in in{536,856}"
tshark -r tmp.pcap -Y "http.request_in == 536 || http.response_in == 856"

when I run:

tshark -r tmp.pcap -Y "http.response_in == 856"

then no frame is shown. Wireshark shows with the same filter the frame 536.

The filter:

"frame.number == 536 || frame.number == 856"

works the same in tshark and wireshark. What am I missing?

the_paul

asked 2022-08-20 20:54:25 +0000

edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

Sort by

oldest

newest

most voted

From the Wireshark Developer's Guide:

Wireshark dissects packets in what it calls 'two-pass' dissection.
...
Wireshark later performs 'second pass' ad-hoc dissections on the packets that it needs data from. This enables Wireshark to fill in fields that require future knowledge, like the 'response in frame #' fields, and correctly calculate reassembly frame dependencies.

tshark does a single pass unless told to make a second pass with the -2 option:

-2
Perform a two-pass analysis. This causes TShark to buffer output until the entire first pass is done, but allows it to fill in fields that require future knowledge, such as 'response in frame #' fields. Also permits reassembly frame dependencies to be calculated correctly.

>tshark -r http.cap -T fields -e frame.number -e http.request_in -e http.response_in -Y http
4
18
27      18
38      4

>tshark -r http.cap -2 -T fields -e frame.number -e http.request_in -e http.response_in -Y http
4               38
18              27
27      18
38      4

Chuckc

answered 2022-08-21 10:32:06 +0000, updated 2022-08-21 10:34:52 +0000

edit flag offensive 0 remove flag delete link

Comments

i was only aware of the -R parameter. Fast and educational, the perfect answer. thank you very much!

the_paul (2022-08-21 12:16:31 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

tshark http.response_in not working edit

Comments

1 Answer

Comments