This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why Wireshark display filter does not show http packets?

2
1

Hi,

When I use display filter for HTTP it shows only HTTP packets when HTTP message is on standard port i.e. on port 80. But, when message is not using standard port, then display filter not works for HTTP and I need to filter for TCP and then need to find out HTTP packets manually.

I want to know why this happen? Is it standard behavior or I am doing (or expecting) it wrongly.

Thanks.

asked 07 Nov '13, 22:22

pranitkothari's gravatar image

pranitkothari
515610
accept rate: 100%


One Answer:

3

It is normal behavior. If you want to be able to use the "http" filter for HTTP traffic on non-standard ports you need to tell Wireshark that it IS in fact http on that port. You can do that in the preferences of the HTTP protocol decoder (there's a list of ports that you can edit).

answered 07 Nov '13, 23:16

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 08 Nov '13, 03:17