sudo tshark -Y "http.request or tls.handshake.type == 1" -T fields -e http.request.method -e http.host -e http.request.uri -e tls.handshake.extensions_server_name
| Argument | Description |
|---|---|
-Y "http.request or tls.handshake.type == 1" |
Filters for HTTP requests or TLS ClientHello packets |
-T fields |
Outputs the following fields |
-e http.request.method |
Displays the HTTP request method |
-e http.host |
Displays the HTTP host header (domain name) |
-e http.request.uri |
Displays the URI of the HTTP request |
-e tls.handshake.extensions_server_name |
Displays the server name from the TLS handshake |
Source link
lol
