I need a perl script (open to suggestions on language) to parse through an archived pcap file and extract out all search terms that are present in the network traffic. This is accomplished by searching each packet for a query string(?) in the GET request or in the referrer tag. Below is an example where "milk and cookies" was the search string and is represented in the header as "&q=milk+and+cookies".
GET /search?sclient=psy&hl=en&rlz=1G1GGLQ_ENUS239&q=milk+and+cookies&aq=f&aqi=&aql=&oq=milk+and+cookies&pbx=1&bav=on.2,or.r_gc.r_pw.&fp=9b0622c6e20bd&tch=1&ech=1&psi=uOGVTbS_A4PegQegiyCA13016682843 HTTP/1.1
The desired output is text file report that would show all search terms found along with the time and date stamp of packet or frame number so it can be found and confirmed in the raw pcap. The output would hopefully look similar to this:
[login to view URL]
**Time/Date Search Strings**
Date: Fri, 01 Apr 2011 14:38:50 GMT milk and cookies
Date: Fri, 01 Apr 2011 16:43:12 GMT dog trainers