tshark

tcpdump -i eno2 -K -n -nn vlan 1998 and vlan 161 and icmp and src 1.2.3.4

tshark -Y 'http' -T fields -e frame.number  -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e http.request.full_uri -r dump.pcap 

tshark -Y 'http.request.full_uri contains "site.net"' -r dump.pcap

tshark   -r dump.pcap -V frame.number == 1