This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

no HTTP packets being captured

0

hello, i use WS to capture the packtes from and to my IP-Camera Sony RZ-50 but Wireshark dont shows HTTP Packets in the Capture file. i dont have a Capture Filter running and i use the newest stable version 1.4.6

thanx in advance Michael

asked 03 May '11, 13:06

haylebob's gravatar image

haylebob
1223
accept rate: 0%

Can you provide some more details (like the network interface used and how you're creating traffic)? If you don't see http in the capture, what traffic do you see?

(03 May '11, 18:00) helloworld

Hello,

thank u for ur answer. the network interface is Realtek 10/100/1000 Ethenet NIC and i only get TCP Traffic Packages in the capture. I creating traffic by open my Brower FF 4.01 or IE8 for example and accessing my IP-Cam Sony RZ50 for checking what is tranferred to and from the Camera.

best regards Michael

(06 May '11, 00:36) haylebob

2 Answers:

1

You might actually be using HTTPS, in which case the traffic is encrypted and would not show as HTTP. You can setup Wireshark with the keys to decrypt the traffic, but it might require recompiling Wireshark for SSL decryption support. See the Wireshark wiki for more on this.

If you're on Windows and interested only in HTTP(S) capturing, you should consider using Fiddler instead because it has better support for decrypting HTTPS.

EDIT: Ok, so you're not using HTTPS. Then you should at least see HTTP in your packet capture when you "login" to the Welcome Page of the network camera (can you confirm?). As a sanity check, I would also confirm that you're really monitoring the correct network interface (in case you have multiple interfaces available).

Based on the user manual of the RZ50N, a Sony-proprietary ActiveX Control (IE Plugin) is installed to monitor/control the camera. This plugin probably uses some protocol on top of TCP (other than HTTP) for that. So, you might only see a few HTTP packets from your intitial "login" (there's actually no username/password prompt at the Welcome Page), followed by something else when the plugin takes over.

If you provide a sample packet capture (starting from initial login), we could help you some more.

answered 06 May '11, 21:18

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

edited 09 May '11, 15:55

0

hello,

thank you for tha answer. i dont using HTTPS or SSL decrpytion here.

best regards Michael

answered 08 May '11, 21:23

haylebob's gravatar image

haylebob
1223
accept rate: 0%