Hello How i can filter only Http.cookie before starting capture? when i use http filter i dont get any packets, but when i dont choose any filter i get all packets, ! i know that i can use http.cookie filter when capturing, but is there anyway to only capture http.cookie from all sites?? thanks asked 17 Aug '13, 13:03  itboys |
2 Answers:
You can't create a capture filter that looks for a specific cookie, as that filter would need to loop through the http headers to find the line cookie header. Capture filters use BPF and are executed in the kernel, that's why a jump backwards (needed for the loop) is not allowed to prevent an infinite loop in the kernel. What you can do is filter on port 80 during capturing and the filter for the cookie when analyzing the data. answered 17 Aug '13, 15:32  SYN-bit ♦♦ |
No, it is not possible to capture only HTTP cookies (see the answer of @SYN-bit). However, if you just need the Cookie names and the values, you can use ngrep on several Unix systems (Linux, etc.) and even on Windows.
This will look for the string "Cookie:" (the HTTP header) on all HTTP connections (port 80). The output looks like this (several cookies in use at the sample page). Then pipe that output into a script and extract whatever you need. Optionally, you can write the matched packets to a file and then analyze that file with wireshark/tshark.
Regards answered 18 Aug '13, 14:42  Kurt Knochner ♦ edited 18 Aug '13, 15:08 |
