Hi all, I have always wondered is there an easy way to extract the web pages that have been visited from a capture. For example let's say I have a 30 min capture of all traffic from a user and I want a simple list of the websites he/she has visited i.e. facebook bbc etc. Is there an easy way to do this in wireshark or with another tool (by feeding in the pcap)? Regards J asked 28 Jun '12, 06:08  j-man9 |
2 Answers:
Sorry all - I found the answer here: http://ask.wireshark.org/questions/7040/how-to-monitor-what-websites-are-visited Basically: Go to Statistics | HTTP | Load Distribution and type http.host. Now look at the "HTTP Requests by HTTP Hosts". This will show you all the HTTP type traffic coming in and out of your network. And it works pretty well too! ta J answered 28 Jun '12, 06:15 j-man9 |
This doesn't shows https websites. Is there a way to use Load distribution feature for https traffic answered 07 Apr '15, 18:45  karan kapoor |
