This is our old Q&A Site. Please post any new questions and answers at

I'm trying to build a filter that will show me HTTP packets that have the Media Type as application/pdf. So far, "media contains application" is not bringing them up; however it will bring up other packets in the capture such as javascript, octect-stream, and x-msdownload. Simply using "media" will gain me these packets, but I'd like to be more precise. Thanks!

asked 24 Dec '13, 05:44

Rob_D's gravatar image

accept rate: 0%

edited 24 Dec '13, 05:44

Please try one of these:

http.content_type == "application/pdf"


http.content_type contains "pdf"


frame contains "application/pdf"


permanent link

answered 25 Dec '13, 00:18

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

The first 2 worked exactly as I needed! Thanks Kurt!

(28 Dec '13, 10:59) Rob_D

Rob one method I have seen work is to do a follow stream at the start of the packet. Its important to know the beginning and end packets. Do a save as and select your filetype i.e. "pdf". So first filter the correct ip & time. Do a follow stream then save as. This might help.alt text

permanent link

answered 24 Dec '13, 20:55

rayyai%20beach's gravatar image

rayyai beach
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Dec '13, 05:44

question was seen: 9,164 times

last updated: 28 Dec '13, 10:59

p​o​w​e​r​e​d by O​S​Q​A