This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Need to check amount of downloaded data from some address when there are connection issues. Such issues are emulated with clumsy. All packets that are received from specific host are filtered by WireShark using following filter: http.host == "mybucket.s3.amazonaws.com". Then I can view length of received packets in Summary (Statistic->Summary), but it shows only 'green' packets. So, is it not correct amount of downloaded data. How I can view amount of of downloaded data for a specific host?

asked 16 Sep '14, 11:29

izdryk's gravatar image

izdryk
11223
accept rate: 0%

edited 22 Oct '14, 02:37

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572


but it shows only 'green' packets. So, is it not correct amount of downloaded data. How I can view amount of of downloaded data for a specific host?

I'm not sure what you mean by 'green' packets, but your filter will only show frames that contain a HTTP Host: header with the mentioned content. That's of course not all frames of the TCP session! It will show just the HTTP request frames which contain that Host: header.

You could try filter on

ip.src eq mybucket.s3.amazonaws.com

HINT: Wireshark will resolve mybucket.s3.amazonaws.com to an IP address before it builds the filter. As Amazon might return several IP addresses for that name, even different ones for several DNS requests (DNS balancing), the filter might look for the wrong IP address. So, the best way would be to identify the session you are looking for with your first filter

http.host == "mybucket.s3.amazonaws.com"

Then try to figure out all server IP addresses matching that name (the destination IP addresses where the HTTP requests were sent to). Then take those IP addresses and build one or more filters to view all frames coming from those servers, aka. the downloaded data.

ip.src eq 176.32.100.72 or ip.src eq 176.32.100.75 or ip.src eq 176.32.100.80

Regards
Kurt

permanent link

answered 22 Oct '14, 05:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×122

question asked: 16 Sep '14, 11:29

question was seen: 4,101 times

last updated: 22 Oct '14, 05:06

p​o​w​e​r​e​d by O​S​Q​A