I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields option. Currently, I am using following command to capture google IP and number of connections.
tshark -r mytest.pcap -T fields -e frame.time -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.addr | grep "google.com"
