Sniff (HTTP/2 | gRPC) Headers with tshark

sniff-grpc.sh

#!/usr/bin/env bash

[ $# -eq 1 ] || (echo "Usage: ${0} PORT" && exit 1)
echo "capturing HTTP/2 headers on ${1}"

tshark -i lo0 \
  -l -Q \
  -T fields \
  -E aggregator="|" \
  -e tcp.port \
  -e http2.header.name \
  -e http2.header.value \
  -Y "http2.header.count > 0" \
  "tcp port ${1}" | while read ports names vals; do
    printf "\033[1;31m${ports%|*}→${ports#*|}\033[0m :: "
    paste -d "|" \
      <(echo ${names} | tr "|" "\n") \
      <(echo ${vals} | tr "|" "\n") | \
      awk -F"|" '{ printf "\033[1;32m%s\033[0m=\033[1;34m\"%s\"\033[0m ", $1, $2 }'
    printf "\n"
  done