I'm working on a web capture script where I only want to dump the traffic if the HTML body or URL contains a string defined in a .txt file.
Here is my tshark command which dumps
src ip dest url (HTTP host) which works like a charm.
tshark -i eth1 'port 80' -R 'http.request' -T fields \ -e frame.number -e frame.time -e ip.src -e http.host \ -e http.request.uri -E header=y -E separator=, \ -E quote=d -E occurrence=f
Now here is where im stuck. How do I go about only triggering this dump when a user browses to lets say hidemyass or the HTML body contains key words like porn?