 | 1 | initial version |
If it is HTTP then the TCP payload from the server will start with "HTTP"
The data to the server will mostly start with "GET" or "POST"
If it is HTTPS you will see a TLS header
HTTP display filter
tcp.payload[0:4]=="HTTP" or tcp.payload[0:3]=="GET" or tcp.payload[0:4]=="POST"
TLS (HTTPS) display filter
1703:00<tcp.payload[0:3]<1703:05
Hope this answer helps .. .
Regards Matthias
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.