How can I display-filter the correspondant response to a specific display-filtered request in wireshark?
You can do it with tshark
follow the below steps:
- Filter all HTTP packets with specific pattern in request uri
- Follow TCP stream based on src IP, src port, dst IP, dst port
$ tshark -r x.pcap -R 'http.request.uri matches "^/resource/to/be/tested"' \ -T fields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | \ while read line; do tshark -r x.pcap \ -R "http && ip.addr == `echo $line | awk '{ print $1 }'` && \ tcp.port == `echo $line | awk '{ print $2 }'` && \ ip.addr == `echo $line | awk '{ print $3 }'` && \ tcp.port == `echo $line | awk '{ print $4 }'`" \ echo done