 | 1 | initial version |
If it is HTTP then the TCP payload from the server will start with "HTTP"
The data to the server will mostly start with "GET" or "POST"
If it is HTTPS you will see a TLS header
HTTP display filter
tcp.payload[0:4]=="HTTP" or tcp.payload[0:3]=="GET" or tcp.payload[0:4]=="POST"
TLS (HTTPS) display filter
1703:00<tcp.payload[0:3]<1703:05
Hope this answer helps .. .
Regards Matthias