CF-Connecting-IP

Hello,

I would like to capture CloudFlare's CF-Connecting-IP special header (client's IP) due to an ongoing DDoS attack. Actually, i want to see the IPs that have the larger number of connections.

But since we are behind cloud flare, we need to use the header CF-Connecting-IP.

How can i do that using Wireshark?

Thanks S.