What display filter can I use for http? I am looking for test string "content" within the Info.
The info field display the full URL with the hostname but I am looking specifically for a subdirectory /content.
Please help!
First time using this forum
This is a display filter:
http contains "content"
Replace content with whatever you are searching. For example:
http contains "cnn"
will display all the HTTP requests/responses with cnn
I think it is case sensitive so be careful what you place within the quotation marks. Hope this answers your question.
Answer above is helpful but there were few issues.
I used the suggested display filter http.host contains ".com" and it resulted with packets containing web hosts accessed using http protocol. But the URL were not visible in any column. Had to do few clicks to see each url/website
I had to specify ".com" to view the url/website which contained .com. If I wanted to view all the url in the pcap file, that wasn't possible by using http.host contains display filter
Moreover it didn't show any host/url which were accessed using https.
To view the URL, I had to expand Hypertext Transfer Protocol within Frame detail window by clicking > and then I was able to see the field Host: webpage.com . Same steps had to be taken for every other packets to see the URL accessed (URL were listed under > Hypertest ...
Asked: 2018-10-04 16:38:43 +0000
Seen: 3,101 times
Last updated: Mar 21 '19
