title: How do I use tshark to print request-response pairs from a pcap file?
body: <p>Given a pcap file, I'm able to extract a lot of information from the reconstructed HTTP request and responses using the <a href="http://www.wireshark.org/docs/dfref/h/http.html" rel="noreferrer">neat filters provided by Wireshark</a>. I've also been able to <a href="http://ask.wireshark.org/questions/4677/easy-way-to-save-tcp-streams" rel="noreferrer">split the pcap file into each TCP stream</a>.</p>
  
  <p>Trouble I'm running into now is that of all the cool filters I'm able to use with <code>tshark</code>, I can't find one that will let me print out full request/response bodies. I'm calling something like this:</p>
  
  <pre><code> tshark -r dump.pcap -R "tcp.stream==123 and http.request" -T fields -e http.request.uri
  </code></pre>
  
  <p>Is there some filter name I can pass to <code>-e</code> to get the request/response body? The closest I've come is to use the <code>-V</code> flag, but it also prints out a bunch of information I don't necessary want and want to avoid having to kludge out with a "dumb" filter.</p>