This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Filter(show)a URL Webserver using a wireshark

0

How can I see which particular web server has been used on particular URL(Web Site)? Which filter and command do I have to use?

asked 10 Oct '12, 06:18

marsal's gravatar image

marsal
1●3●3●5
accept rate: 0%

edited 10 Oct '12, 06:23

One Answer:

1

which particular web server has been used on particular URL(Web Site)?

Maybe I'm getting your question wrong, but the HTTP Host header (the accessed server) is usually the same as the host part in the URL (what you type in the browser - http://host/xxxx). So, the accessed web server is the same as the host in the URL !??!

Regards
Kurt

answered 10 Oct '12, 06:42

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Thanks for your answering my question(s)!! Well I would like to elaborate my question. I have to find which webserver has been used for example for http://www.conrad.ch, www.sbb.ch, www.microsoft.ch. Thank you Kurt in advance!

Regards

marsal

(13 Oct '12, 00:11) marsal

I'm sorry, but I still don't get it :-)

What do you mean be "which webserver has been used for example for http://www.conrad.ch"?

  • What exactly do you need? The IP address of that server?
  • The server name?
  • The IP address of the clients accessing that server?
  • Anything else?

Regards
Kurt

(13 Oct '12, 01:37) Kurt Knochner ♦

the name please! and the command on the wireshark how do I filter that! I am sorry but my technical English is not so good.

(13 Oct '12, 02:28) marsal
1

I am sorry but my technical English is not so good.

Your english is not worse than mine ;-)

O.K. isn't the name of the server in the URL http://www.sbb.ch equal to www.sbb.ch?

So, the best I can tell you is this. Use a Display Filter like this:

http.request and http.host eq "www.sbb.ch"

and you will get

  • the IP address(es) of all clients talking to that host
  • the IP address(es) of www.sbb.ch
  • the 'name' of the server in the HTTP Host header (open the HTTP details to see the 'Host:' header)
  • the requested URL (in the Info column or in the HTTP details)

Please tell me, if you need any other information.

(13 Oct '12, 12:25) Kurt Knochner ♦

Thanks Kurt!

(23 Oct '12, 04:54) marsal