Watching http in wireshark

Question

Wireshark reassembles TCP Segments. For teaching purposes, I'd like to see the actual packets (not the reassembled TCP Segments) that flow on a network when you access a webpage.

Can I do that with Wireshark? If not, can you suggest a free program that will let me see the basic, fundamental packets?

Answer 1

If you want to view only http packets in wireshark

• Start the wireshark
• Select your network adaptor
• In Filter box enter 'http' and then apply.

Answer 2

This can help you filter out non-HTTP traffic. Then you can simply look at the packets:

6.1. Viewing packets you have captured

Once you have captured some packets, or you have opened a previously saved capture file, you can view the packets that are displayed in the packet list pane by simply clicking on a packet in the packet list pane, which will bring up the selected packet in the tree view and byte view panes.

You can also disable packet reassembling as shown here. Fiddler may also be a good choice if you want to look at HTTP layer.