Ask Your Question

Revision history [back]

Wireshark generates fields to correlate HTTP requests and responses, so you can do this with a little work.

Apply a display filter of "http.request && !http.request.uri contains "/URL" Note the "!". You are displaying all the requests whose responses you are not interested in.

Click on Edit > Ignore All Displayed.

Now to display the responses you are interested in, apply the display filter "http.request_in".

To see the requests and their matched responses use "http.request and http.request_in".

Wireshark generates fields to correlate HTTP requests and responses, so you can do this with a little work.

Apply a display filter of "http.request && !http.request.uri contains "/URL" Note the "!". You are displaying all the requests whose responses you are not interested in.

Click on Edit > Ignore All Displayed.

Now to display the responses you are interested in, apply the display filter "http.request_in".

To see the requests and their matched responses use "http.request and && http.request_in".

Wireshark generates fields to correlate HTTP requests and responses, so you can do this with a little work.

Apply a display filter of "http.request && !http.request.uri contains "/URL" Note the "!". You are displaying all the requests whose responses you are not interested in.

Click on Edit > Ignore All Displayed.

Now to display the responses you are interested in, apply the display filter "http.request_in".

To see the requests and their matched responses use "http.request && http.request_in".

Based on the information you added in your comment, to find all the responses that had a response code other than 200, the display filter would be: "http.request_in && !http.response.code==200".