Following HTTP streams was a great addition, particularly when trying to follow servers which send their HTML content gzip'ed. Strangely enough, the 'HTTP stream' in the popup dialog (or the main menu for that matter), isn't alwys enabled - even when I am clearly inside a TCP packet. (BTW it worked yesterday, same session, even the same capture). When does the HTTP stream option get enabled? Do I have to do anything special? asked 01 Jan '17, 08:05  jcoppens |
One Answer:
Hello again, Thanks for reading the original question, and commenting! I've been suffering the follow-up of an Achilles tendon rupture and haven't really been on the computer much. Sorry for the delay in replying! If I'm not mistaken, my complaint originates from the fact that in the actual Wireshark version, it is necessary to click on the first packet of a TCP stream (i.e. GET, POST, etc). I believe that, when following TCP streams was first implemented (in the last instances of the 1.x series), I could click on any packet of a TCP stream and still get the entire thread selected. Could that be? answered 13 Jan '17, 13:10 jcoppens edited 13 Jan '17, 13:12 |
Have you selected a packet which has the "HTTP" layer?
can you share your pcap ?