Ask Your Question

Revision history [back]

If you have plain http traffic, then the URL will be in the http.request.full_uri field.

You can see this in action if you download the sample http capture from the wiki and open it in Wireshark and select packet 4 in the packet list, in the protocol details pane, expand the Hypertext Transfer Protocol item and look at the [Full request URI:...]" field.

The field can be added as a column, by right-clicking it and selecting "Apply as Column".