Capture Only HTTP traffic in tshark

Question

I am new to tshark tool usage. I am trying to use tshark tool for capturing only HTTP traffic but i am unable to do it. Here is the cmd i run to get the all traffic:

tshark -c 1000 -w packetFile.pcap 

Anyway i can filter out only http traffic?

Solution

Use a display filter:

tshark -Y http

If you need to save the capture, you can run the display filter on the output:

tshark -r packetFile.pcap -Y http -w packetFile-http.pcap

Comments

[brablc]

Display filter is nice, but for capturing only http, this can be used: tshark -f 'port http'