# Generate report by http hosts in tcpdump / wireshark capture

**URL:** <https://linux-tips.com/t/generate-report-by-http-hosts-in-tcpdump-wireshark-capture/813>\
**Category:** Network\
**Created:** [December 9, 2020, 10:24am UTC](https://linux-tips.com/t/generate-report-by-http-hosts-in-tcpdump-wireshark-capture/813 "2020-12-09T10:24:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![DrSlump](https://linux-tips.com/user_avatar/linux-tips.com/drslump/32/61_2.png) [@DrSlump](https://linux-tips.com/u/DrSlump)\
**Post date:** [December 9, 2020, 10:24am UTC](https://linux-tips.com/t/generate-report-by-http-hosts-in-tcpdump-wireshark-capture/813/1 "2020-12-09T10:24:19Z")

</div>

Assume that you have captured some network traffic and want to generate a report to see how many requests comes for specific http hostname.

It is possible to filter by **http.host** or **http.request.method** in wireshark but it does not have this type of reporting functionality.

You can generate a report with the help of less known but important **tshark** utility and standard tools on console:

```auto
tshark -r capture.pcap -Y "http.request.method==GET" -T fields -e "http.host"

```

After that you can send this output to `sort | uniq -c | sort -n` pipe to sort by the number of requests each http.host received.

This is just a basic example of tshark’s capabilities, you can use lots of filters to create advanced reports.