This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

google search display filter

0

Hi,

i am a newbie and are playing with wireshark.

I am trying to write a displayfilter that shows the google seach request done during the capture session.

as example i did a seach on google for "tablet"and "Ferrari" and now i want to create a filter that show me the seaches on google.

I tried this

http.host contains google http.request.uri contains google

But stil i dont see the words i have seached for.

Is there anyone who knows how to do this ?

Thanks in advance !

asked 24 May '13, 09:13

Johnny-b's gravatar image

Johnny-b
11●1●1●3
accept rate: 0%

One Answer:

2

You could try something like http.request.uri contains "q=Ferrari" and http.host==www.google.com, since google uses a parameter called "q" to name the search key words.

Filtering for all packets containing a google search request might work like this: http.request.uri contains "q=" and http.host==www.google.com

answered 24 May '13, 09:25

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

edited 24 May '13, 09:28

1

This will only work if the Google search is being run on plain old http. If the search is using https, then the traffic will be encrypted and you won't be able to see anything.

(24 May '13, 09:43) grahamb ♦
1

Correct, but I assumed that that topic with https is a well known thing :-) But it's probably good to emphasize it again, just to make sure.

(24 May '13, 09:46) Jasper ♦♦

Hi Jasper,

thanks this is just i needed, i can see the searches now .

And Graham your correct about the HTTPS , but i just used the old plain HTTP

anaway thanks for the help and info on this.

Johnny-b

(24 May '13, 10:48) Johnny-b

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(24 May '13, 14:16) grahamb ♦