This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

filter application/pdf media type

0

I'm trying to build a filter that will show me HTTP packets that have the Media Type as application/pdf. So far, "media contains application" is not bringing them up; however it will bring up other packets in the capture such as javascript, octect-stream, and x-msdownload. Simply using "media" will gain me these packets, but I'd like to be more precise. Thanks!

asked 24 Dec '13, 05:44

Rob_D's gravatar image

Rob_D
1●1●1●2
accept rate: 0%

edited 24 Dec '13, 05:44

2 Answers:

2

Please try one of these:

http.content_type == "application/pdf"

or

http.content_type contains "pdf"

or

frame contains "application/pdf"

Regards
Kurt

answered 25 Dec '13, 00:18

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

The first 2 worked exactly as I needed! Thanks Kurt!

(28 Dec '13, 10:59) Rob_D

0

Rob one method I have seen work is to do a follow stream at the start of the packet. Its important to know the beginning and end packets. Do a save as and select your filetype i.e. "pdf". So first filter the correct ip & time. Do a follow stream then save as. This might help.alt text

answered 24 Dec '13, 20:55

rayyai%20beach's gravatar image

rayyai beach
40●3
accept rate: 0%