How to create a filter for a particular field?

Question

Hi, I want to create a display filter for a particular field. Please help me to finish my task.

HTTP Header:

Hypertext Transfer Protocol

POST / HTTP/1.1\r\n Content-Type: text/xml; charset=utf-8\r\n SOAPAction: "create"\r\n

Here, I want to create filter for the “SOAPAction” field.

Answer 1

The HTTP field list doesn't include SOAPAction, so SOAPAction is added as a simple text item. You can filter for it in a couple ways:

Option 1: Custom HTTP header field

Add a custom header field to your HTTP preferences (requires Wireshark restart), which allows you to filter for the field.

Open menu: Edit > Preferences > Protocols > HTTP > Custom HTTP headers fields
Click New
For Header name, enter SOAPAction
For Field desc, enter Intent of SOAP HTTP request (or whatever)
Click OK
Restart Wireshark.
In the Display Filter textbox, enter http.header.SOAPAction, and click Apply. The textbox background should turn green, indicating the display filter syntax is correct (and that our preference changes for the custom field SOAPAction took effect).

Option 2: String matching display filter

This display filter scans entire HTTP packets for the string "SOAPAction:". This might be inefficient compared to a custom HTTP header field, but it works well.

http contains "SOAPAction:"