Read easily proxified trafic

retag add tags

Hello, My question may be very simple, I don't know. I am looking for a method or function in wireshark to extract the web stream (http and https ssl...) proxyfied on a standard port (8080). Then, my need is to be able to easily extract this web traffic in order to make it easily readable to make other measurements on it (delta time). I am looking to observe degraded response times on real-time streams. The problem I'm looking to observe is probably not on the response times between the proxy and the client but on the processing of the flows that pass through it. I would like to observe L7 session aisily of tcp session (http / https / ssl...) I thank you very much if you can give me some ideas for analysis. Eric

breizho

asked 2023-10-11 16:51:07 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Hello,

Not idea about this need ?

Regards,

Breizho

breizho (2023-10-14 10:21:18 +0000) edit

add a comment see more comments

I (and probably others) have read your question and could not make full sense of it. Wireshark will show proxied traffic just as well as non-proxied traffic.

If I read your question as if you want to know how to easily match clientside traffic to serverside traffic, then the answer is that there is no general way that requests on the client side can be matched on the server side of the proxy, as the proxy might alter the requests. So that is something you will have to do by hand or by some form of scripting (Lua post-dissector or postprocessing tshark output for example).

If there is anything specific in your traffic that you can make the match with, that would be great, otherwise I'm afraid you will need to do a lot of it manually

18.5k

SYN-bit

answered 2023-10-14 10:40:43 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Read easily proxified trafic edit

Comments

1 Answer

Comments