http headers tshark

gistfile1.txt

# localhost 
sudo tshark -i lo

# or add loopback interface 
sudo ifconfig lo0 alias 127.0.0.0 up
sudo tshark -i lo0

# eth0
sudo tshark -i eth0 -f 'port 80 or 443' -R 'http.host matches ".*?youtube\.com.*"' -S -V -l -T fields -e ip.src -e ip.src_host -e ip.dst -e ip.dst_host -e http.accept -e http.accept_encoding -e http.accept_language -e http.authbasic -e http.authorization -e http.cache_control -e http.connection -e http.content_encoding -e http.content_length -e http.content_length_header -e http.content_type -e http.cookie -e http.date -e http.host -e http.last_modified -e http.location -e http.notification -e http.proxy_authenticate -e http.proxy_authorization -e http.proxy_connect_host -e http.proxy_connect_port -e http.referer -e http.request -e http.request.full_uri -e http.request.method -e http.request.uri -e http.request.version -e http.response -e http.response.code -e http.response.phrase -e http.sec_websocket_accept -e http.sec_websocket_extensions -e http.sec_websocket_key -e http.sec_websocket_protocol -e http.sec_websocket_version -e http.server -e http.set_cookie -e http.transfer_encoding -e http.upgrade -e http.user_agent -e http.www_authenticate -e http.x_forwarded_for -E header=y -Eseparator=, -Equote=d