I'd like to filter some specific HTTP requests (for a specific domain for ex) and show only the response code of those filtered requests.
Isn't it possible with something like a macro, or a $_ variable or http.request_in ?
http.host contains "iwaxx" || corresponding_http.response.code
This would show 1 line for request and 1 line for response code.
Change 31184 added a field http.response_for.uri that contains as much of the request URI as is available.
This could be used in the first part of your filter as:
http.response_for.uri contains "iwaxx" || ...
Unfortunately the change hasn't (yet) been backported so you'll need to either use one of the automated builds produced since the change was merged, or build your own version from master.
Awesome, thanks for the answer and the work : perfectly on time for my needs ! On each release, would this new filter be advertised somewhere, like in the release note?
Such minor changes don't normally get announced, the closest we have to that for fields is the Display Filter Reference.
Maybe we should have a list somewhere for each release of field changes. This would require a tool of some sort added to the codebase so a Bugzilla Enhancement Request would be the place for this.
Asked: 2019-01-10 14:20:39 +0000
Seen: 701 times
Last updated: Jan 10 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
