This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
2
1

Hi,

When I use display filter for HTTP it shows only HTTP packets when HTTP message is on standard port i.e. on port 80. But, when message is not using standard port, then display filter not works for HTTP and I need to filter for TCP and then need to find out HTTP packets manually.

I want to know why this happen? Is it standard behavior or I am doing (or expecting) it wrongly.

Thanks.

asked 07 Nov '13, 22:22

pranitkothari's gravatar image

pranitkothari
515610
accept rate: 100%


It is normal behavior. If you want to be able to use the "http" filter for HTTP traffic on non-standard ports you need to tell Wireshark that it IS in fact http on that port. You can do that in the preferences of the HTTP protocol decoder (there's a list of ports that you can edit).

permanent link

answered 07 Nov '13, 23:16

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 08 Nov '13, 03:17

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×349
×165
×63
×15

question asked: 07 Nov '13, 22:22

question was seen: 9,859 times

last updated: 08 Nov '13, 03:17

p​o​w​e​r​e​d by O​S​Q​A