schernic
7/9/2015 - 7:18 AM

tshark

tshark

incoming get requests

sudo tshark -s 0 -Y 'ip.dst_host=="10.88.0.180"&&http.request.method=="GET"'



count incomping calls to uri '/imp? .....'

sudo tshark -s 0 -f 'dst 10.88.0.180' -q -z 'io,stat,60,COUNT(http.request.uri)http.request.uri contains "imp?"'


parameters:
        -f: capture filter - low level filter by port / ip / etc. for more information google tpcdump
        -q: disables output of each single request to console
        -z io,stat,interval,"[COUNT|SUM|MIN|MAX|AVG|LOAD](field)filter: collect statistics, interval in seconds, field must be part of filter, filter uses display filter syntax
        -Y: display filter - filter by e.g. protocol, uri, etc.