This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

easy way to extract websites visited from a capture

0

Hi all,

I have always wondered is there an easy way to extract the web pages that have been visited from a capture.

For example let's say I have a 30 min capture of all traffic from a user and I want a simple list of the websites he/she has visited i.e. facebook bbc etc. Is there an easy way to do this in wireshark or with another tool (by feeding in the pcap)?

Regards

J

asked 28 Jun '12, 06:08

j-man9's gravatar image

j-man9
1111
accept rate: 0%


2 Answers:

0

Sorry all - I found the answer here: http://ask.wireshark.org/questions/7040/how-to-monitor-what-websites-are-visited

Basically: Go to Statistics | HTTP | Load Distribution and type http.host. Now look at the "HTTP Requests by HTTP Hosts". This will show you all the HTTP type traffic coming in and out of your network.

And it works pretty well too! ta

J

answered 28 Jun '12, 06:15

j-man9's gravatar image

j-man9
1111
accept rate: 0%

0

This doesn't shows https websites. Is there a way to use Load distribution feature for https traffic

answered 07 Apr '15, 18:45

karan%20kapoor's gravatar image

karan kapoor
1
accept rate: 0%