Below is a screen shot of HTTP flows: GET request spans packet 4 and 5, while response is packet 9:
To filter HTTP stream, if use -Y http only:
$ tshark -nr tcp.pcap -Y http -w http.pcap
Only the last segment of GET request will be saved to file:
So -2 option is needed:
$ tshark -nr tcp.pcap -Y http -2 -w http.pcap
This time, the full GET request is saved:
