Example. I visit http://www.google.com/ and I am redirected to Https://www.google.com/. Where can I see that redirect?
Okay, that's a tricky combination. Let's see, we have:
Since the filter has to hit on the response, we have no access to the original request. But we do know it's to an HTTP address, so we may assume the server TCP port used is 80.
The redirect is done with the HTTP response code 302. That is clearly present in the response.
The redirect also must contain a HTTP location header, which according to the stated question, must have "https://" in the address.
Using this combination I would probably arrive at this filter:
(tcp.srcport == 80) && (http.response.code == 302) && (http.location contains "https://")
Hello, Thanks for the response, but it is not working for me. Maybe I'm doing something wrong. I type http://www.google.com/ and I get redirected to https://www.google.com/. U applied your filter but I dont see any packets.
Are you certain that there is a redirect?
I ran Wireshark and then typed "http://www.google.com" into my browser, but I don't see any HTTP-over-TCP traffic to www.google.com - it appears that the browser tried HTTP-over-TLS without trying HTTP-over-TCP first. (That even happens if I try http://www.google.com:80!)
Perhaps Safari either just tries HTTP-over-TLS first for all attempts, or remembers that it's used HTTP-over-TLS in the past for www.google.com and tries it first? Perhaps your browser does the same?
Asked: 2018-12-09 08:19:25 +0000
Seen: 8,846 times
Last updated: Dec 09 '18
