Ask Your Question

How to find which computers are connected during the HTTP transfer?

asked 2021-03-19 01:10:37 +0000

mayazec gravatar image

My question is to find which computers are connected during the HTTP transfer, by only following the SYN packets. I have filtered on Wireshark the following command: tcp.flags.syn && http. I have got the following output: image description. I wanted to know how can I find which were those computers, is that meant by Source or?

edit retag flag offensive close merge delete


Can you tell us wether or not his is a question in your homework?

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2021-03-22 08:02:18 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2021-03-22 08:01:34 +0000

hugo.vanderkooij gravatar image

There are more ways to fry this fish.

You can also check all the statistcics and see who is busy with HTTP traffic for example.

edit flag offensive delete link more

answered 2021-03-19 01:26:40 +0000

Chuckc gravatar image

tcp.flags.syn && http will match all TCP packets that are http protocol.
It is looking for the existance of tcp.flags.syn, not what state it is set to.

If you're looking to match SYN packets then the filter will be tcp.flags.syn ==1 && http but at that early stage in the conversation the protocol is not known so there will be no match on http.

If the http server is listening on the default port 80 then try this filter:

(tcp.flags.syn == 1 && tcp.port == 80)
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2021-03-19 01:10:37 +0000

Seen: 311 times

Last updated: Mar 22 '21