-1

I have a pcap file and that contain some http media.type (pdf) . I can able to export media type from wireshark gui. I tried
tshark -r run.pcap -T fields -e media.type > sample.raw but no result.

Please help me to figure out the issue .

James Arems
  • 87
  • 3
  • 11

1 Answers1

0

The content type field's name, for HTTP, is http.content_type, not media.type. Try

tshark -r run.pcap -T fields -e http.content_type > sample.raw
user9065877
  • 193
  • 1
  • 1
  • 2