To do that, choose an http request in the main windows where you see all the packets, right-click on it, and choose the option “Follow TCP Stream.” Wireshark will open a new window containing the reconstruction of that entire HTTP session in chronological order. Perhaps you are interested in following a particular kind of information, or a particular user. Each web page that any users on your network visits will generate this kind of traffic for you to catch – which may be a lot of information. You can click on Edit -> Preferences -> Protocols -> HTTP and verify that “Uncompress entity bodies” is checked.ĭuring the capture, set a filter to show only HTTP traffic by entering http. Today, most HTTP traffic is compressed to speed up the exchange of information, so by default Wireshark decompresses the body part of HTTP packets. As before, start Wireshark and start capturing the traffic from the interface that goes out.

Here’s another classic example – an HTTP session. In this article we’ll see how apply BPF filters to wireshark to show the details of an HTTP session, an e-mail session and how to monitor who is visiting a certain site from our local network.įinally I will make a summary of the most useful filters to use with Wireshark.

This is an article of mine, first published on Wazi

Wireshark display filters