This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Follow related connections

0

I am somewhat familiar with TCP WireShark, etc. Mediocore I guess. I have a question: Many times I get spam mail from whomever. I am a curious fellow and wonder what the source of it is. Many times I get a link to click on so I can, according the instructions, log in to fix up my userid/password. Yeah, right. I know it's not probably recommended, but I fire up WireShark and try to follow what happens when I click such a link. Most times, there is one conversation that ends with a 320, re-direct. Follow conversation does not seem to follow that. I'm not sure if I'm making sense, but is there any way of following that first request, typicall a GET through it's travels including re-directs to other hosts? That is, I end up seeing the entire flow?

Thanks for any tips suggestions.

asked 17 Feb '14, 11:11

larryralph's gravatar image

larryralph
11223
accept rate: 0%

Sorry, should have been a '302 Redirect'. I guess I could then follow that redirected conversation, but was wonder if there was some way (a filter?), do that automatically??

Gracias

(17 Feb '14, 11:16) larryralph

One Answer:

0

Guess I should have done some searching first. I think I found the answer in this very forum. Here's a link to what I found. I will try the filter technique mentioned: http://ask.wireshark.org/questions/27616/follow-http-redirects-automatically-http-status-codes-301302?

answered 17 Feb '14, 11:55

larryralph's gravatar image

larryralph
11223
accept rate: 0%