easypi/tshark repository overview

$ alias tshark='docker run --rm -it --net=host --cap-add=NET_RAW --cap-add=NET_ADMIN -v $PWD/data -w /data easypi/tshark'
# Extract HTTP URLs live
$ tshark -i eth0 -Y "http.request" -T fields -e http.host -e http.request.uri
# Extract HTTPS domains (TLS SNI)
$ tshark -i eth0 -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name
# Combined HTTP + HTTPS sniffer
$ tshark -i eth0 -Y "http.request or tls.handshake.type == 1" -T fields -e http.request.method -e http.host -e http.request.uri -e tls.handshake.extensions_server_name