8

I am trying to show only HTTP traffic in the capture window of Wireshark but I cannot figure out the syntax for the capture filter.

I have tried suggestions for old versions of Wireshark but with no success.

I have this current filter:

ip host 192.168.0.201

Meaning that I want to capture packets from and to that IP address. I need to add a filter to see only HTTP traffic.

I have tried:

  • ip host 192.168.0.201 http
  • ip host 192.168.0.201 and ip.proto == 'http'
  • and a lot of other combinations but none worked.

This is the actual capture session, so that you can figure out what the problem is:

Capture session

4
  • Did you try entering the actual port number of HTTP (port 80) instead of 'http'
    – Kirill2485
    Jun 30, 2017 at 21:53
  • Port is 8080.... but I don't want to filter by port but by protocol... protocol http means methods Get or Post.. when I don't filter by protocol, I get entries with http and tcp protocols, both using sale port 8080. Since tcp entries are the most, I need to filter them.
    – jstuardo
    Jun 30, 2017 at 22:29
  • If you just want to monitor GET and POST requests a website, the Chrome developer tools let you do that. Just press F12 and go to "Network"
    – Kirill2485
    Jul 1, 2017 at 0:28
  • No....you cannot suppose this is a PC. This is actually a device that sends requests to a website and receive responses from it. That traffic is what I need to monitor. That is the reason I need a tool such as Wireshark.
    – jstuardo
    Jul 1, 2017 at 0:34

4 Answers 4

4

Since there isn't a straightforward answer to the original question, maybe this helps others. If you want to filter to only see the HTTP protocol results of a wireshark capture, you need to add the following filter:

http

Yep, that's it. In the case in the above question, that means setting the filter to:

ip.addr==192.168.0.201 and http

Note that what makes it work is changing ip.proto == 'http' to http

3

Based on your comments, if you only want to filter HTTP POST or GET messages you could use the following filter:

http.request.method == GET or http.request.method == POST and ip.host == 192.168.0.201

Tested with 2.2.6

wireshark screenshot

2
  • This does not meet the requirement. I can do that, but I can only see the GET and POST request made by 192.168.0.201. I also need to capture the server response. For example, When the device sends a GET or POST request, the server responds with an OK or depending on the requested command, That is why I need to capture HTTP protocol. Please see my question edit. You can see there the request and the OK sent by the server. You will also see a lot of TCP entries that belongs to the acknowledge mechanism of the transport protocol.
    – jstuardo
    Jul 1, 2017 at 15:16
  • Oh I'm sorry. I just read "protocol http means methods Get or Post...". I don't really agree with that statement, but that's what you asked for... I'm sorry to have wasted your time with my obviously wrong answer.
    – mtak
    Jul 2, 2017 at 14:43
0

You can filter on IP address and port with ip.addr==192.168.0.201 and tcp.port==8080 to display only packets to TCP port 8080. If, you want to be more specific regarding the HTTP traffic, i.e., you only want to see packets where the method is GET or POST you could use http.request.method == method, e.g., http.request.method == GET, instead of tcp.port==8080.

3
  • I used this capture filter "host 192.168.0.201 and (port 8080 or port 80)" but it also capture TCP entries because they occur also in 8080 port. Please see my question edit.
    – jstuardo
    Jul 1, 2017 at 15:19
  • I have finally used this display filter: "http"... and it works. However, it also captures error packets, which are displayed in red in Wireshark. Is there a way to filter that?
    – jstuardo
    Jul 1, 2017 at 18:18
  • @jstuardo, to eliminate the ones with errors, try adding and not _ws.expert.severity==error to the filter you are using - expert.severity==error works for me with Wireshark 1.10.14 on a Linux system, but you may need to use _ws.expert.severity==error for your version. I have to use the latter version with Wireshark 2.2.5 on my MacBook Pro laptop.
    – moonpoint
    Jul 2, 2017 at 18:50
-1

Just try this, it works.

ip.addr == 192.168.2.11 and tcp

Put the style in the wireshark filter, it will filter the tcp protocol. Very simple.

3
  • Welcome to Super User! Can you edit your answer to explain what you are suggesting and why it works? Cheers
    – bertieb
    Apr 3, 2019 at 9:01
  • Put the form in wireshark, it will filter the tcp protocol. Very simple. I don't understand why you downvote my answer. @bertieb Apr 3, 2019 at 11:51
  • 1
    I didn't downvote your answer, and I cannot speak for whoever did. However you could improve this answer but editing it and adding an explanation, particular why someone should use this variant rather than the others suggested. Cheers
    – bertieb
    Apr 3, 2019 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .