OSQA is unmaintained. Help us figure out where to go from here.

I "inherited" a custom sniffer program that is capturing traffic using libpcap.

When I try to use display filters such as "http.request" and "http.response", no traffic is displayed in Wireshark. However, when I just use "http", I see all of the packets I would expect.

Can anyone give me some hints as to what I should be looking at more closely at this custom code that would affect the ability to use these filters? I'm not a libpcap expert

asked 28 Oct '11, 11:36

dturkel's gravatar image

accept rate: 0%

Another option: Your sniffer program limits the capture to the first 68 bytes of the frame. Then you'll have http, but the dissector is unable to parse an http request or response field. Hence the http display filter works, http.request and http.response don't.

permanent link

answered 29 Oct '11, 11:13

Jaap's gravatar image

Jaap ♦
accept rate: 14%

The same thought occurred to me this morning over coffee. There was an option to provide the number of bytes to capture, and I increased this... and bingo, problem solved. Thanks very much!

(29 Oct '11, 15:19) dturkel

libpcap doesn't use Wireshark display filters, it uses capture filters. It seems that your custom sniffer appends your filter string to "port ", then feeds it to libpcap. That way "port http" results in BPF filter code, while compilation of "port http.request" and "http.response" does not.

permanent link

answered 28 Oct '11, 15:08

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Thanks Jaap.

What I'm trying to do is select/display a capture from the custom sniffer in Wireshark, applying the display filter "http.response".

The custom sniffer does not apply any filters (which is desired, because there are quite a few other non-http filters that need to be applied as well (e.g. for SMB and other higher-level protocols).

(28 Oct '11, 15:55) dturkel

libcap does not accept wireskark filters but tcpdump filters.

Look at justniffer for an example of sniffer using libcap libraries

permanent link

answered 03 Nov '11, 04:13

Augustyn's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Oct '11, 11:36

question was seen: 2,371 times

last updated: 03 Nov '11, 04:13

p​o​w​e​r​e​d by O​S​Q​A