This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to filter Wireshark so it only shows traffic from one particular website visited?

0

I started a capture and visited a couple of websites.

I need to use a filter expression to only view traffic from one of the websites visited.

I'm not sure how to do this.

Any help?

asked 08 Nov '14, 09:57

MacTavish_10's gravatar image

MacTavish_10
11●2●2●4
accept rate: 0%

One Answer:

0

There are more ways to do it:

  • Get the ip address of the webserver (e.g. 'ping www.wireshark.org') and use the display filter 'ip.addr==looked-up-ip-address' or
  • Use the filter 'http.host==www.wireshark.com' to get the POST/GET request followed by 'Follow TCP stream' to get the complete TCP session.

answered 11 Nov '14, 06:59

Uli's gravatar image

Uli
903●1●5●15
accept rate: 29%