What the display filter to only see traffic for a particular website?

edit

Hi,

This is how I do it but there are probably other (better?) ways.

Capture all traffic when you are browsing to the website.

When you are done close your browser and then stop the capture.

You'll need to use display filters to all the information.

DNS

Use this display filter to find the DNS queries and answers for the domain:

dns.qry.name contains "www.yahoo.com

(Deprecated using dns contains www.yahoo.com after reading Jim's comment.)

There are probably a lot of DNS for a site like Yahoo so if you want everything you need to make a note of every IP addresses in the answer field of every DNS packets.

TCP (HTTP)

You can now display all TCP SYN segment with this filter.

(tcp.flags.syn == 1) && (tcp.flags.ack == 0)

You need to find the TCP stream index where the destination IP address matches the IP address from the DNS answer.

You may build a more complex filter using the IP addresses you found to (somewhat) automate this process.

ip.dst in {1.2.3.4 5.6.7.8 9.0.1.2} && (tcp.flags.syn == 1) && (tcp.flags.ack == 0)

You can then find all the TCP stream indexes of all the Yahoo related TCP conversations.

This will include HTTP/HTTPS.

ALL THAT JAZZ

Display everything with a new display filter.

dns contains www.yahoo.com || tcp.stream in {10 20 30}

Hope this helps.

Cheers,

JF

DNS for www.yahoo.com use dns contains www.yahoo.com

TCP handshake for www.yahoo.com TCP hand shake will be with what ever ip address is resolved against www.yahoo.com Remember these days opening a webpage is not a tcp threeway handshake with single resolved ip address. I have seen multiple tcp sessions for single website.

HTTP GET request http.host contains "www.yahoo.com"

I have just opened yahoo and it was https so use ssl.handshake.extensions_server_name == "www.yahoo.com"

so the possible combination for display filter will be

dns contains www.yahoo.com || http.host contains "www.yahoo.com" || ssl.handshake.extensions_server_name == "www.yahoo.com"