This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi!

I suspect some snowiness between two of my servers being due to one of them sending some requests in HTTP 1.0 while the other always replies in HTPP 1.1. To confirm it I listened the traffic between both, but now I would like to filter HTTP 1.0 packets to confirm they are one sided and slow.

How do I do that? I tried "http.request.version 1.0" but wireshark don't want it

asked 12 Mar '14, 04:23

petitpoisson's gravatar image

petitpoisson
6112
accept rate: 0%


Try something like

http.request.version == "HTTP/1.0"

You need to tell Wireshark what you're looking for. You were pretty close though :-)

Tip: if you want to filter on something that you can see in a packet, right click on that field and select the popup menu option "Apply as Filter -> Selected". It helps a lot.

permanent link

answered 12 Mar '14, 04:38

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 12 Mar '14, 04:38

Try http.request.version == "HTTP/1.0".

You can always work out what the filter should be by right clicking on the field in the Packet Details pane and selecting "Apply as Filter ..." then "Selected".

permanent link

answered 12 Mar '14, 04:40

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Dup, @Jasper's too quick today.

(12 Mar '14, 04:40) grahamb ♦

Sorry... but almost identical answers, great minds think alike I guess :-)))

(12 Mar '14, 06:12) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×293
×165

question asked: 12 Mar '14, 04:23

question was seen: 7,210 times

last updated: 12 Mar '14, 06:12

p​o​w​e​r​e​d by O​S​Q​A