Get HTTP request by tshark from pcap

http-request.sh

#!/bin/bash

######
# https://ask.wireshark.org/questions/14811/follow-tcp-stream-with-tshark-still-can-not-in-batch-mode
# Useage: http_header.sh *.pcap
######
filter='http'
files=$(ls $@)

filter_http () {
# TCP stream IDs
TCP_STREAMS=$(tshark -r "$files" -2 -R "$filter" -T fields -e tcp.stream|sort -n -u)

# filter by each stream ID
for stream in ${TCP_STREAMS}
do
	tshark -r "$files" -q -z follow,tcp,ascii,$stream
done
}

for f in $files
do
	filter_http $f |awk -f http-request.awk
done

# content of http-request.awk
:<<awk
BEGIN{flag=0}
/ HTTP\//{print "## BEGIN";print;flag=1;next}
flag==1 && !/^\s*[0-9]+$/{print;next}
flag==1 && /^\s*[0-9]+$/{print "## END";flag=0}
awk