Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

If it is HTTP then the TCP payload from the server will start with "HTTP"
The data to the server will mostly start with "GET" or "POST"

If it is HTTPS you will see a TLS header
HTTP display filter

tcp.payload[0:4]=="HTTP" or tcp.payload[0:3]=="GET" or tcp.payload[0:4]=="POST"

TLS (HTTPS) display filter


Hope this answer helps .. .
Regards Matthias