First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

How to "follow http stream" for single line in wireshark?

I'm using wireshark to capture network traffic ( http).

Current filter is : 

ip.dst== 192.168.11.210 and http and ip.src==192.168.50.75

I already see the filtered http request and response:

enter image description here

I want to see the (HTTP) request and response ,
So I was told to "follow tcp/http stream".

And so I did - right click on the last row :

enter image description here

But the problem is that I see all the Http requests (not only the one I selected):

enter image description here

Question:

How can I see the http request only for the selected row ?

Royi's avatar
1
Royi
asked 2018-05-03 11:50:15 +0000
cmaynard's avatar
11.1k
cmaynard
updated 2018-10-26 14:16:47 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

At a glance, I can't find any easy/easier way to do this. See below:

Right click on the packet(s) you're interested in and mark them. Then go to File > Export Specified Packets > Select the radio button "Marked Packets". The result is a capture file with only the marked packet(s). From there you can select follow TCP stream and you'll have it isolated to what you're interested in. This solution doesn't scale very well, but for grabbing/analyzing a few packets it works fine. Additionally, you can click around in the ASCII breakdown of the stream and Wireshark will select the related packet in the decode pane.

Shan's avatar
1
Shan
answered 2018-05-03 12:54:30 +0000, updated 2018-05-03 13:03:46 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Thanks for reply. I did what you told me to do , but "export specified packets" is disabled ...

https://i.imgur.com/gOHepd3.jpg

here

Royi's avatar Royi (2018-05-03 15:10:58 +0000) edit
more
  • delete

The only thing I can think of that is causing an issue is that you have a capture running while trying to perform the export. Can you try stopping the capture, and then exporting? Let me know if that helps.

Shan's avatar Shan (2018-05-03 16:34:45 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer