wireshark - Use Tshark to view json data -

when use tshark decode capfile this

 tshark -v -r test.cap  -y 'http>0' 

i got

... javascript object notation: application/json     object         member key: "ret"             number value: 99         member key: "message"             string value:test 

question how can json data use tshark

... {"ret":99,"message":"test"} 

had similar problem. failed solved wireshark/tshark options only. below workaround extracting raw json , xml cap files.

# 1. convert pdml disabled json , xml dissectors tshark -r "wireshark.cap" -2 -r "http" --disable-protocol json --disable-protocol xml -v -t pdml > "wireshark.cap.pdml.xml"   # 2. hex encoded raw data media.type pdml element # 3. perform hex decode 

i used groovy script steps 2 , 3

import groovy.xml.*  ...  def string hexdecode(string s) {     if ( null == s || 0 == s.length() ) {              return null     }        def res = ""     (int = 0; < s?.length(); += 2) {             res += (character)((character.digit(s.charat(i), 16) << 4) + character.digit(s.charat(i+1), 16))     }        return res  }  ...  def xmlfile = new file("wireshark.cap.pdml.xml") def pdml  = new xmlparser().parsetext( xmlfile.text ) pdml.packet.each{ packet->     def media = packet.proto.find{ "media"==it.@name }     def hex  = media?.field.find{"media.type"==it.@name }?.@value     def raw = hexdecode(hex) }