Ask Your Question
0

Don't see request for HTTP protocol

asked 2018-06-06 10:08:49 +0000

romario4 gravatar image

updated 2018-06-06 10:12:31 +0000

I am using a win service that is sending a POST request to some host. I'm able to filter/catch it in Wireshark and there is a response there, but nothing about request and its headers. Could you someone show me the right way, please :) Screenshot is below Thank you.

I'm using v.2.6.1. Windows 10 x64

https://ibb.co/jHoiF8 https://ibb.co/jHoiF8

edit retag flag offensive close merge delete

Comments

do you see the request if you Follow the tcp stream?

thetechfirm gravatar imagethetechfirm ( 2018-06-06 14:16:36 +0000 )edit

No. Under "Entire Conversation" dropdown list it states that no request was sent to target destination (0 bytes) Only response is available.

Screenshot - https://ibb.co/fJaBL8

romario4 gravatar imageromario4 ( 2018-06-06 14:26:05 +0000 )edit

Could you make the entire capture available on some site, so we can download it and look at it?

If not, could you show us the summaries of packets 1 through 59?

Guy Harris gravatar imageGuy Harris ( 2018-06-06 20:30:09 +0000 )edit

Try this link - https://ufile.io/71mrj Is this what you need? There are packets from #53 to #62 only related to the destination IP.

romario4 gravatar imageromario4 ( 2018-06-07 09:47:53 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
1

answered 2018-06-08 04:27:54 +0000

Rooster_50 gravatar image

Your capture contains only traffic from the Server to the Client. The reason may be due to the way you obtained your capture. If you did a port span, you may have only spanned the Tx of the server switch port and not both Tx and Rx.

Can you provide any information on how you are capturing your data?

edit flag offensive delete link more

Comments

Sure.

  1. Start Wireshark.exe
  2. Select inteface to capture traffic
  3. Capture has started and to filter the incoming data I use "ip.addr == xxxx.xxxx.xx.xx" as a display filter. (I know the DNS name, ping the server and get the ip address. ip.addr filter as I know gets the data where specified IP is used for source OR destination)
romario4 gravatar imageromario4 ( 2018-06-08 10:30:40 +0000 )edit

"Start Wireshark.exe" on what? The server itself, or are you capturing from another machine? If from another machine, how are you capturing the data to/from the server? Port Span, TAP, L1 Hub, etc?

Rooster_50 gravatar imageRooster_50 ( 2018-06-09 05:26:57 +0000 )edit

Hm.. I am starting it on my local notebook. With default settings just choosing the interface (Ethernet #..) from the list. Start catching traffic and the filter it with display filter.

I believe there is no port span or tap. Not sure what is L1 Hub.

Just to make an analogy with Fiddler - you start the app, do your http things in the browser and see all the requests/responses there. My expectations were the same using wireshark :)

romario4 gravatar imageromario4 ( 2018-06-09 06:10:40 +0000 )edit

Am I doing something wrong on the app start?

romario4 gravatar imageromario4 ( 2018-06-11 12:17:41 +0000 )edit
0

answered 2018-06-12 17:06:19 +0000

romario4 gravatar image

I think I found the answer... I uninstalled 2.6.1 version and installed - Old Stable Release (2.4.7) With 2.4.7 everything works and I see the requests (POST/GET/etc)

Bug in 2.6.1?

Thanks!

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-06-06 10:08:49 +0000

Seen: 6,151 times

Last updated: Jun 12 '18