This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all

No packets are captured when i try to find out http traffic (tcp port 80). Althuogh I can find them when I capture all packets (e.g. without any capture filter), applying display filter.

I ran Wireshark as administrator but the problem remained.

Windows 7 Wireshark 1.6.5

Thanks in advance

asked 18 Feb '12, 01:36

clipsya's gravatar image

clipsya
1112
accept rate: 0%

edited 18 Feb '12, 01:38

The capture filter "tcp port 80" or "tcp port http" works fine for me. Do you see any traffic with the above filters?

(18 Feb '12, 03:20) grahamb ♦

thanks but both filters "tcp port 80" and "tcp port http" don't capture anything

(18 Feb '12, 05:13) clipsya

And if you remove the capture filter you see tcp traffic on port 80? And you aren't making any other changes? Very odd.

(18 Feb '12, 05:57) grahamb ♦

yes, as I mentioned above if I don't apply any capture filter all of the packets are captured successfuly and I can find http packets among all of it using display filter. But it is not convenient way for me :(

(18 Feb '12, 06:15) clipsya

If you do see HTTP packets when you don't use a capture filter and you don't see HTTP when you do use a capture filter, then the capture filter filters the HTTP packets out. This usually happens when traffic is being encapsulated. Depending on the encapsulation type, you need to extend the capture filter:

  • 802.1Q vlan tagging : vlan and tcp port 80
  • PPPoE : pppoes and tcp port 80

If these do not work for you, please update this question with the full (text) output of 1 HTTP packet to check what encapsulation you are encountering.

permanent link

answered 18 Feb '12, 06:15

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 18 Feb '12, 06:22

Great thanks! PPPoE is my case! I didn' t even think about encapsulation.. Thanks a lot again!

(18 Feb '12, 06:27) clipsya
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×349
×32
×4
×2

question asked: 18 Feb '12, 01:36

question was seen: 9,213 times

last updated: 18 Feb '12, 06:27

p​o​w​e​r​e​d by O​S​Q​A