This is our old Q&A Site. Please post any new questions and answers at

Can someone tell me how I set this up for capture? I'm trying to discover delayed http responses to http requests from a particular PC on our LAN. It's IP address is I don't know the web server's address yet but I will in a minute so we can just make one up for now for this discussion.

asked 19 Jul '13, 11:33

WineGeek's gravatar image

accept rate: 0%

I would do it this way.

Display filter: ip.addr eq and (http.request or http.response)

Then set the Time column to the following format

View -> Time Display Format -> Seconds Since Beginning of Capture

As the client is also able to send several requests at the same time (in different TCP connections) you need to check the TCP Stream number as well. For this purpose, please add a new column in the GUI for the value. Here is how to do this

Edit -> Preferences -> User Interface -> Columns

Add a column called "TCP Stream". Then choose Custom as type and as value.

GUI column preferences

Then sort the GUI by the "TCP Stream" column.


Then use a Time Reference (CTRL-T in the GUI) for easy delta time calculation between request and response. As you can see the 'delay' (delta) between request and response is 2.144 seconds for the first request and 0.2605 for the second request.

You can also use tshark with some scripting:

tshark -nr input.pcap -R "ip.addr eq and (http.request or http.response)" -T fields -e frame.number -e frame.time_relative -e ip.src -e ip.dst -e -e http.request.full_uri -e http.response.code -e http.response.phrase


permanent link

answered 22 Jul '13, 06:33

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Jul '13, 11:33

question was seen: 8,286 times

last updated: 22 Jul '13, 06:33

p​o​w​e​r​e​d by O​S​Q​A