How can I do this in Wireshark? asked 18 Apr '11, 09:32  Bruce |
One Answer:
Do you want to add the HTTP header "Content-Length" as a column? You can achieve that by rightclicking on the "Content-Length" header in the packet details pane. Then you can choose "Apply as Column". If you are using a version lower than 1.4.0, you can do it by opening the column preferences and then add a custom column with the field name "http.content_length_header". (There is no field in wireshark that shows you the length of the HTTP headers, so if that was your question, it is not possible currently) answered 18 Apr '11, 13:43  SYN-bit ♦♦ |
@SYNbit: Can I write a plugin or something to do that? Once I get access to the raw data its easy to find out the header length. Will wireshark allow me to do this?
You might be able to write a LUA script that does what you need. You can also write a plugin, but that would replace the HTTP dissector which might not be what you want. The easiest though, would be to add this functionality to the existing http dissector (epan/dissectors/packet-http.c).
If you do add fields for the HTTP header length, I would suggest using http.request.header_length and http.response.header_length.
It would be great if you can submit your patch to the wireshark repository for others to use as well. You can add it at https://bugs.wireshark.org :-)