#!/bin/bash

if [ $# -eq 0 ]; then
    echo "Must give a PCAP file (and I won't check if it is one)."
	echo "Use this at your own risk!"
	echo "Pls. read some more in the script."
    exit 0
fi

raw=$1
i=$(echo $raw|sed 's/\.pcap//')	#obviously, if the ext of your PCAP not
								# '.pcap', modify
#This line sorts the uri's alphabetically
tshark -q -r $i.pcap -T fields \
	-e 'http.request.full_uri' | sort -u > ${i}-http-request-full_uri.txt
#This line only greps for lines with founds -- no alpha after numbers and
# space, not grep'ed in. Good for looking up that frame number in Wireshark
tshark -q -r $i.pcap -T fields \
	-e 'frame.number' -e 'http.request.full_uri' | grep \
	-E '^[0-9]{1,9}[[:space:]][[:alpha:]]' \
	> ${i}-frame-http-request-full_uri.txt