Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic.

I can open the pcap file in wireshark and it shows what you can see in the attached screenshot , but I don't find a way to see ip addresses or http messages. If I filter for http I get an empy list.

How can I make wireshark showing me the captured http traffic?

enter image description here

share|improve this question
up vote 0 down vote accepted

type http into the filter box hit enter

enter image description here

share|improve this answer
This gives me an empty list. – BetaRide Oct 29 '12 at 13:29
Then your capture has no HTTP traffic in it. Eek – squarebear Oct 29 '12 at 13:31
You are absolutely right. I'm on a WPA encrypted network. After setting the WPA key in wireshark I started to see http trafic. – BetaRide Oct 30 '12 at 6:26

If you are only interested in http traffic, I would recommend Fiddler instead of Wireshark. It's not as powerful as Wireshark, but speaking of HTTP traffic, I think it's much easier to use and understand.

share|improve this answer
"Fiddler is a Web Debugging Proxy which logs all HTTP(S) traffic between your computer and the Internet". I need to analyze everything on my WLAN and I don't have a Windows box at hand. – BetaRide Oct 29 '12 at 13:12
Yes - as the brightly colored jellybeans in the window title bar and scrollbar indicate, this is OS X, not Windows. There's a Web debugging proxy for OS X, named Charles, but if you want to analyze third-party traffic (as in "I need to analyze everything on my WLAN), then, as noted, a Web debugging proxy is insufficient. – user164970 Sep 16 '15 at 20:34

As noted, it's encrypted traffic on a "protected" network (WEP or WPA/WPA2), so you need to provide the network password to allow Wireshark to decrypt it and, for WPA/WPA2 networks, such as this network, you also have to make sure you capture the EAPOL handshakes for any devices whose traffic should be decrypted.

See the Wireshark Wiki page on decrypting 802.11 for details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.