This is our old Q&A Site. Please post any new questions and answers at

How can I do this in Wireshark?

asked 18 Apr '11, 09:32

Bruce's gravatar image

accept rate: 0%

Do you want to add the HTTP header "Content-Length" as a column? You can achieve that by rightclicking on the "Content-Length" header in the packet details pane. Then you can choose "Apply as Column". If you are using a version lower than 1.4.0, you can do it by opening the column preferences and then add a custom column with the field name "http.content_length_header".

(There is no field in wireshark that shows you the length of the HTTP headers, so if that was your question, it is not possible currently)

permanent link

answered 18 Apr '11, 13:43

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

@SYNbit: Can I write a plugin or something to do that? Once I get access to the raw data its easy to find out the header length. Will wireshark allow me to do this?

(18 Apr '11, 21:55) Bruce

You might be able to write a LUA script that does what you need. You can also write a plugin, but that would replace the HTTP dissector which might not be what you want. The easiest though, would be to add this functionality to the existing http dissector (epan/dissectors/packet-http.c).

(18 Apr '11, 23:56) SYN-bit ♦♦

If you do add fields for the HTTP header length, I would suggest using http.request.header_length and http.response.header_length.

It would be great if you can submit your patch to the wireshark repository for others to use as well. You can add it at :-)

(19 Apr '11, 03:35) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 18 Apr '11, 09:32

question was seen: 13,549 times

last updated: 19 Apr '11, 03:35

p​o​w​e​r​e​d by O​S​Q​A