This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to save only http packets in a pcap file ?

0

Using wireshark, can I save just the http packets to a pcap file. My capture stream consists of a large number of packets, out which only 10% are http packets. I want to save only HTTP packets to the pcap file by applying some sort of filter before saving the file.

asked 18 Jun '15, 14:32

Backspace's gravatar image

Backspace
31347
accept rate: 0%


One Answer:

1

you could filter on "http" to get all packets that Wireshark considers to be HTTP, and then use "Export specified packets" to save only the currently displayed packets to a new file.

answered 18 Jun '15, 14:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%