After some sniffing i can see profiles being viewed, photos being looked at etc - I'm looking to see if i can see if a message is sent to a person. I searched for things containing "message" but no returns.
Does anyone know what to filter on to see when i message someone?
asked 08 Nov '11, 12:30
This display filter worked in July:
but it looks like Facebook recently changed their protocol. Try this new display filter:
The display filter explained:
Using only the second predicate (similar to the working filter in July) may suffice, but it might catch some unwanted packets that coincidentally contain "
EDIT: If your Facebook settings have Secure Browsing enabled, Wireshark can't see the contents of your outgoing IMs (but it can still detect the TLS packet). Even if you turn off Secure Browsing in Facebook, that only affects your own IMs. Your friend can still turn his Secure Browsing on, which protects his IMs from Wireshark.
answered 08 Nov '11, 16:18
edited 09 Nov '11, 15:46
ip.addr == 192.168.1.xxx and http.host==www.facebook.com && data-text-lines contains user-generated-message
replace ip address with the one you want to follow or omit to scan all users messages like this...
http.host==www.facebook.com && data-text-lines contains user-generated-message
as always it will not work if secure browsing is enabled.
answered 22 Mar '12, 16:35
edited 22 Mar '12, 16:38
Actually I found out, that somehow the relevant packages are compressed since a few weeks, so the search-function can not longer be used, instead of this I use the filterstring http && data-text-lines contains "subject" and then I only klick on html-packets with plain text, then on the lower tabs I choose the uncompressed view to see the chat-messages. Works for other social-networks like "Wer kennt wen" too.
answered 26 Mar '12, 05:09