Display filter not showing HTTP packets

asked 2020-03-10 08:46:59 +0000

edgarpet
1 ●1 ●1 ●1

Hi all,

I have two packets with src port == 8080 and dst port == 6006 (which is x11) and when applying the display filter of 'http' I do not see those packets. Port 8080 is configured for http in the protocol preferences. The packets simply show as tcp. Only if I add port 6006 to http preferences I am able to see the packet when filtering - but that is not a solution for me.

Can anyone help/advise?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2020-03-10 12:35:27 +0000

Chuckc
2808 ●5 ●566 ●19

Can you put a script wrapper around Wireshark and specify the port at startup?

https://www.wireshark.org/docs/man-pa...

-d <layer type>==<selector>,<decode-as protocol>
Like Wireshark's Decode As... feature, this lets you specify how a layer type should be dissected. If the layer type in question (for example, tcp.port or udp.port for a TCP or UDP port number) has the specified selector value, packets should be dissected as the specified protocol.

Example: -d tcp.port==8888,http will decode any traffic running over TCP port 8888 as HTTP.

See the tshark(1) manual page for more examples.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-03-10 08:46:59 +0000

Seen: 1,087 times

Last updated: Mar 10 '20

Display filter not showing HTTP packets edit

1 Answer