title: tshark capture cookie information
body: <p>I am new to wireshark/tshark, so I want to know if something like that is possible. I have captured some traffic as pcap file. I open it up in wireshark and apply 'http.cookie' filter, it only gives me packets with cookies in them. and from those packets I only need specific HTTP information, like source/destination ip, timestamp, http.content_type, http.content_length, cookie ID string and full request uri. It is somewhat possible in wireshark. but that all is done on a offline capture pcap file stored in computer. </p>
  
  <p>Is there a way by using tshark on an interface that I ONLY CAPTURE HTTP PACKETS WITH COOKIES in them ? and then extract specific information into a file. I been googling a lot, and have tried so many examples , but getting confused a lot. </p>
  
  <p>I think I am confused with capture filters and read filters, can anyone help me in that? </p>