up vote 1 down vote favorite
share [g+] share [fb]

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything?

I would like to analyse some packets related to one website in particular, but how can I do this when there's such a large number of packets in Wireshark?

link|improve this question
Have a look at capture filters - wiki.wireshark.org/CaptureFilters – arunkumar Sep 4 '11 at 20:42
1  
Your network adapter is doing all sorts of coordination on a network that you don't see, and doesn't require interaction. You will need to apply a filter to WireShark for HTTP traffic to make any sense of it. – vcsjones Sep 4 '11 at 20:42
probably find the website's IP and filter to just packets with that source or dest IP. – barlop Sep 5 '11 at 2:24
feedback

migrated from stackoverflow.com Sep 4 '11 at 21:27

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 1 down vote

Are you filtering wireshark to http packets only? Wireshark will pick up all network traffic of any sort. If you just want to look at requests for one site then fiddler is probably a better tool as it is geared towards looking at http requests

link|improve this answer
no, I'm supposed to use WireShark only, and could you please give me an example of a good filter expression which can solve my problem? – Jugo Sep 4 '11 at 20:52
feedback
up vote 1 down vote

If you're really not doing anything, you might be seeing traffic that is neither from nor to your machine.

You can prevent this by turning off 'promiscuous mode'.

link|improve this answer
feedback
up vote 1 down vote

A large amount of packets is normal, especially if you're on a busy network and you're in promiscuous mode. To capture packets specifically to or from a certain IP address (your website's, in this case), you would use the capture filter:

host *ip adress*
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard