 | 1 | initial version |
Not that easy to get only responses as the response doesn't carry the request URI so you are looking for an association between packets, i.e. the packets that have the frame number that's in the http.response_in field in the request. That would be a good enhancement request to add the request URI as a generated field to the response, raise it over here.
In the UI, you can expand the HTTP tree in the packet details pane for requests displayed by your filter and then click on the `[Response in frame: xxx] field to jump to the response.
If you use tshark and some scripting you can use -T fields -e http.response_in along with your filter to get a list of the response frames that match your request filter and then create a filter from that list, e.g. -f 'frame.number == x || frame number == y ... to then output the response frames.
