Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything?

I would like to analyse some packets related to one website in particular, but how can I do this when there's such a large number of packets in Wireshark?

share|improve this question

migrated from Sep 4 '11 at 21:27

This question came from our site for professional and enthusiast programmers.

Have a look at capture filters - – arunkumar Sep 4 '11 at 20:42
Your network adapter is doing all sorts of coordination on a network that you don't see, and doesn't require interaction. You will need to apply a filter to WireShark for HTTP traffic to make any sense of it. – vcsjones Sep 4 '11 at 20:42
probably find the website's IP and filter to just packets with that source or dest IP. – barlop Sep 5 '11 at 2:24

Are you filtering wireshark to http packets only? Wireshark will pick up all network traffic of any sort. If you just want to look at requests for one site then fiddler is probably a better tool as it is geared towards looking at http requests

share|improve this answer
no, I'm supposed to use WireShark only, and could you please give me an example of a good filter expression which can solve my problem? – Jugo Sep 4 '11 at 20:52

If you're really not doing anything, you might be seeing traffic that is neither from nor to your machine.

You can prevent this by turning off 'promiscuous mode'.

share|improve this answer

A large amount of packets is normal, especially if you're on a busy network and you're in promiscuous mode. To capture packets specifically to or from a certain IP address (your website's, in this case), you would use the capture filter:

host *ip adress*
share|improve this answer

You must log in to answer this question.