This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture POST requests or websites

0

What is the best way to capture websites? You can type http in the filter, but it is still pretty tedious to find the websites visited and POST requests (because it also shows getting images, css file etc.). Is there anyway I could see the websites nicely? Thanks.

asked 02 May '14, 06:37

tttttttttttt2's gravatar image

tttttttttttt2
347912
accept rate: 0%


One Answer:

1

You could use the Statistics menu, there are some entries for HTTP which will show you the requests in a tree view. It's not very comfortable though.

If you're looking for some way to actually reconstruct and view the web pages as seen by the user Wireshark doesn't help, except for the HTTP object export functionality you can find in the File menu. But then you'd have to open the exported pages as files in a web browser to look at them.

answered 02 May '14, 06:40

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

@Jasper thank you so much for your help. Yeah, I've tried statistics, I can select http.host for example, but I can't (I think) to see just POST requests for example. And no, I don't want to reconstruct and view web pages.

(02 May '14, 06:43) tttttttttttt2

What I usually do is just to filter on "http.request.method" to see all requests (GET, POST etc). If you don't want GIFs etc. showing up you could exclude them by adding things 'and not http.request.full_uri contains ".gif"' or something like that.

The other way to go could be to use the list of requests and export the packet list view to csv. Then go and use Excel (or any other spread sheet tool) to work on the list outside of Wireshark.

(02 May '14, 06:46) Jasper ♦♦