This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display complete HTTP header

1

Wireshark displays [truncated] preceding the HTTP Cookie header. How can I make it capture and display the entire Cookie header?

asked 27 Oct '10, 08:07

matthewlmcclure's gravatar image

matthewlmcclure
16223
accept rate: 0%

Can you use http.cookie as a display filter to see all packets that contain an HTTP cookie and then right-click on one of those packets and select Follow TCP stream? Do you see the entire cookie now?

(27 Oct '10, 20:16) lchappell ♦

One Answer:

2

Wireshark DID capture the whole Cookie Header (assuming that no snaplength was used during capture). However, it has a limit on the length of text to show for one particular item in the protocol detail pane.

When you select the Cookie Header, you can see the whole Cookie Header in HEX & Ascii in the packet bytes pane. Or you can use "Copy Value" to extract the whole Cookie Header into the copy buffer and paste it in a text editor of your choice to view.

answered 28 Oct '10, 15:40

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%