wireshark with SSL traffic and HTTP filter

Swathi,

I am afraid your description is too generic so without the capture file along with the pre-master keys file it is hard to say what may be issues.

So if you can, post both.

But in general: whenever a protocol data unit (PDU) of an application protocol which uses TCP as transport is bigger than the available tcp packet size, it has to be split into several TCP packets. Wireshark shows only the last packet carrying that PDU as containing that application protocol, and the dissection of the PDU is available in that last packet; all the packets before are shown as "segment of a reassembled pdu". Now there are two possible cases:

• all packets of a given PDU are available in the capture; in such case, dissection of each of the segments contains a link to the last one where the complete (reassembled) PDU is shown,

• not all packets of a given PDU are available in the capture; in such case, no link is available in the individual packets because the PDU could not be reassembled.

As for "continuation or non-http traffic", the dissector may be missing the context from the previous packets due to packet loss during capture or because you've started the capture after that http communication has already started.

In general if you're seeing "XXX segment of a reassembled pdu" then you're looking at a middle packet which Wireshark isn't going to show you as HTTP or HTTPS because Wireshark needs the full (reassembled) packet in order to decode it properly. Filter for http or ssl to hide these middle packets and show only the reassembled ones.

Note: it is possible that the reassembly has actually failed in which case you may not see the reassembled packet. That's common when there are TCP retransmissions or out-of-sequence or missing packets. In these cases generally the best you can do is try to get a better capture.

For "continuation or non-http traffic" this usually means Wireshark has missed some packets and is seeing the middle of the HTTP stream without having seen the beginning. This will continue until Wireshark sees another start of an HTTP stream. Again, generally the best you can do is get a better capture that doesn't miss any packets.