Ask Your Question
0

How to "follow http stream" for single line in wireshark?

asked 2018-05-03 11:50:15 +0000

Royi gravatar image

I'm using wireshark to capture network traffic ( http).

Current filter is :

ip.dst== 192.168.11.210 and http and ip.src==192.168.50.75

I already see the filtered http request and response:

enter image description here

I want to see the (HTTP) request and response ,
So I was told to "follow tcp/http stream".

And so I did - right click on the last row :

enter image description here

But the problem is that I see all the Http requests (not only the one I selected):

enter image description here

Question:

How can I see the http request only for the selected row ?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-05-03 12:54:30 +0000

Shan gravatar image

updated 2018-05-03 13:03:46 +0000

At a glance, I can't find any easy/easier way to do this. See below:

Right click on the packet(s) you're interested in and mark them. Then go to File > Export Specified Packets > Select the radio button "Marked Packets". The result is a capture file with only the marked packet(s). From there you can select follow TCP stream and you'll have it isolated to what you're interested in. This solution doesn't scale very well, but for grabbing/analyzing a few packets it works fine. Additionally, you can click around in the ASCII breakdown of the stream and Wireshark will select the related packet in the decode pane.

edit flag offensive delete link more

Comments

Thanks for reply. I did what you told me to do , but "export specified packets" is disabled ...

https://i.imgur.com/gOHepd3.jpg

here

Royi gravatar imageRoyi ( 2018-05-03 15:10:58 +0000 )edit

The only thing I can think of that is causing an issue is that you have a capture running while trying to perform the export. Can you try stopping the capture, and then exporting? Let me know if that helps.

Shan gravatar imageShan ( 2018-05-03 16:34:45 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-05-03 11:50:15 +0000

Seen: 92 times

Last updated: May 03