capture only packets that contain this http header-> Host: mydomain.com

Question

hello i want to capture packets that contain this http header-> Host: mydomain.com if i use http.host display filter all data will be saved to disk and it becomes very large after few minutes is this possible ? or is there any kind of perl or python script written for this ?

Answer 1

You should set a capture filter:

port 80 and host mydomain.com

So Wireshark does not capture other packets. The display filter is like the name says only for hiding packets, so if you remove the filter other packets will show up.
Just a little Tutorial video about setting capture filters, click here.