This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Catch HTTP request with an empty HTTP Referer header

0

The filter

http.referer == ""

will catch both HTTP requests without Referer header and HTTP requests whose Referer header are empty (see this pcap file).

Is there a way to catch the case where the Referer header is present, but it's empty?

Thanks.

asked 11 Apr '16, 15:41

pktUser1001's gravatar image

pktUser1001
201●49●50●54
accept rate: 12%

Thanks @jim-aragon for the answer. I think I am wrong in making the assumption without testing.

(11 Apr '16, 19:16) pktUser1001

One Answer:

1

When I apply that filter (http.referer==""), it does not show requests without a Referer header. I've tested it with v2.0.2, v2.0.2 Legacy, v1.12.8, and v1.10.14. The file you linked to appears to have only one request in it; a request with an empty Referer header. The file does not have a request without a Referer header in it to test against. I used a different file to test if the filter would show requests without a Referer header. It did not. It only showed packets with an empty Referer header.

answered 11 Apr '16, 18:02

Jim%20Aragon's gravatar image

Jim Aragon
7.2k●7●33●118
accept rate: 24%