Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wireshark reassembles TCP Segments. For teaching purposes, I'd like to see the actual packets (not the reassembled TCP Segments) that flow on a network when you access a webpage.

Can I do that with Wireshark? If not, can you suggest a free program that will let me see the basic, fundamental packets?

share|improve this question

migrated from Aug 25 '11 at 15:01

This question came from our site for professional and enthusiast programmers.

If you want to view only http packets in wireshark

  • Start the wireshark
  • Select your network adaptor
  • In Filter box enter 'http' and then apply.
share|improve this answer
What if wireshark doesn't show any HTTP packets, just TCP, UDP, ARP and others? – kev Oct 20 '15 at 0:58

This can help you filter out non-HTTP traffic. Then you can simply look at the packets:

6.1. Viewing packets you have captured

Once you have captured some packets, or you have opened a previously saved capture file, you can view the packets that are displayed in the packet list pane by simply clicking on a packet in the packet list pane, which will bring up the selected packet in the tree view and byte view panes.

You can also disable packet reassembling as shown here. Fiddler may also be a good choice if you want to look at HTTP layer.

share|improve this answer

You must log in to answer this question.