This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to see set-cookie headers

0

How can i see all the set-cookie headers sent to a browser, using wireshark? They at the moment, when doing somehting as simple as signing into yahoo mail, are not visible. I can see requests getting sent by the browser that mysteriously use cookie headers with names/values that are not visible in the preceding responses sent by the server.

asked 29 Nov '11, 15:10

jmu2101's gravatar image

jmu2101
6336
accept rate: 0%


One Answer:

0

Hi,

You can use http.cookie as display filter and have a check on packets.

Later on you can follow the TCP stream and have a check on the HTTP cookie.

GET /complete/search?client=chrome&hl=en-US&q=yahoo HTTP/1.1 Host: www.google.co.in

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.41 Safari/535.7

Accept-Encoding: gzip,deflate,sdch

Accept-Language: en-US,en;q=0.8

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Cookie: SID=DQAAALcAAACokelljJKbxE9ZGtudzZmFNFBu8MrkHl-4oNcLtm_NrfXhTOA7QeEzIbmaXApwQ95XkCIySvRF22vxY3XAIpqH066t8MvhOnNsmwu1_IwYZkdSD753JNLWQfhnfS1HUw9wCYZWsPRwiSF4qAiFPUAtaf3wK2ru2vLGQrC_j5EY7BZX1sWjN_UUCCzt6GwOK-4Vr5BjnxCwqgLCmdClkQpiwIadA26saOvxB6Kdspck7VlSnTa5m0kk4WkQEBqR-fA; HSID=A1t6pt_ata42NbZHj; PREF=ID=cd930011b98dfb6b:U=9929737f5638aa37:FF=4:LD=en:NR=10:TM=1284889587:LM=1322673912:IG=4:SG=1:S=yODOHFCPByV_Fq0j; NID=53=SKIOn45dB6ONuHK6om-7Rt2reUYHaRhRZd07CP8fRrzVgqqEZlSxshTsZt2cHQ56GeHyq5i-g8RnFILgRrjwQX2iwLRyxRhfWD3qmP-Xl6wu84w3a6KXyTapRHRrW6by

If you wish to replay the packet you can use wget or netcat and have it replayed

Hope this helps.

Regards,

-Deepak

answered 30 Nov '11, 09:31

Deepak's gravatar image

Deepak
31225
accept rate: 25%