Extract HTTP error responses from a capture
Build a paste-ready command, then review its compatibility and effects before running it.
tshark -r capture.pcapng -Y 'http.response.code >= 400' -T fields -e frame.time -e ip.src -e http.response.coderead-onlyno known side effects Compatibility
LinuxVerified for Linux using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-20
Requirementstsharktshark must be installed and available on PATH.
Version supporttshark Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsJul 24, 2026 12:14:12.223000 CEST 192.0.2.10 502Representative successful output; values vary with the selected target and system state.
Known errorstshark: command not foundtshark is missing or is not available on PATH.
Verifytshark -r capture.pcapng -Y 'http.response.code >= 400' -T fields -e frame.time -e ip.src -e http.response.codeThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01tsharkCommandRuns the tshark stage of this one-liner.
02-rOptionEnables raw, recursive, or reverse mode for this command.
03capture.pcapngArgumentPasses capture.pcapng to tshark.
04-YOptionConfigures tshark with the -Y option.
05'http.response.code >= 400'ArgumentPasses 'http.response.code >= 400' to tshark.
06-TOptionConfigures tshark with the -T option.
07fieldsArgumentPasses fields to tshark.
08-eOptionConfigures tshark with the -e option.
09frame.timeArgumentPasses frame.time to tshark.
10-eOptionConfigures tshark with the -e option.
11ip.srcArgumentPasses ip.src to tshark.
12-eOptionConfigures tshark with the -e option.
13http.response.codeArgumentPasses http.response.code to tshark.
Example input
tshark -r capture.pcapng -Y 'http.response.code >= 400' -T fields -e frame.time -e ip.src -e http.response.code
Example output
Jul 24, 2026 12:14:12.223000 CEST 192.0.2.10 502
Illustrative output — exact values vary by system and data.
Official sources