read ajp13 packet contents on terminal using tshark 1.4.15

tshark -r *.eth -S -R "ajp13" -d tcp.port==9009,ajp13 -s 0 -l -V | awk '/Apache JServ/ {p=1} /^ *$/ {p=0;printf "\n"} (p){printf "%s\n", $0} /^(Frame|Internet Pro|Transmission Control)/ {print $0}'
if you have a capture file *.eth, and ajp protocol is in use on port 9009, you can paste the above command. You can change the fiile and port name
Sample Output
Frame 9: 928 bytes on wire (7424 bits), 928 bytes captured (7424 bits)
Internet Protocol, Src: (, Dst: (
Transmission Control Protocol, Src Port: 39823 (39823), Dst Port: pichat (9009), Seq: 1, Ack: 1, Len: 860
Apache JServ Protocol v1.3
    Magic: 1234
    Length: 856
    Method: (2) GET
    Version: HTTP/1.1
    URI: /abcd
    PORT: 443
    SSLP: 1
    NHDR: 10
    user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CL
R 3.5.21022)
    accept-encoding: gzip, deflate
    accept-language: en-us
    accept: */*
    connection: Keep-Alive
    cookie: JSESSIONID=D7FD2C7E64995549ABE05776BE01E2EF

2013-01-10 21:12:51

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this? is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.


Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: