First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Don't see request for HTTP protocol

I am using a win service that is sending a POST request to some host. I'm able to filter/catch it in Wireshark and there is a response there, but nothing about request and its headers. Could you someone show me the right way, please :) Screenshot is below Thank you.

I'm using v.2.6.1. Windows 10 x64

https://ibb.co/jHoiF8 https://ibb.co/jHoiF8

romario4's avatar
1
romario4
asked 2018-06-06 10:08:49 +0000, updated 2018-06-06 10:12:31 +0000
edit flag offensive 0 remove flag close merge delete

Comments

do you see the request if you Follow the tcp stream?

thetechfirm's avatar thetechfirm (2018-06-06 14:16:36 +0000) edit
more
  • delete

No. Under "Entire Conversation" dropdown list it states that no request was sent to target destination (0 bytes) Only response is available.

Screenshot - https://ibb.co/fJaBL8

romario4's avatar romario4 (2018-06-06 14:26:05 +0000) edit
more
  • delete

Could you make the entire capture available on some site, so we can download it and look at it?

If not, could you show us the summaries of packets 1 through 59?

Guy Harris's avatar Guy Harris (2018-06-06 20:30:09 +0000) edit
more
  • delete

Try this link - https://ufile.io/71mrj Is this what you need? There are packets from #53 to #62 only related to the destination IP.

romario4's avatar romario4 (2018-06-07 09:47:53 +0000) edit
more
  • delete
add a comment see more comments

2 Answers

1

Your capture contains only traffic from the Server to the Client. The reason may be due to the way you obtained your capture. If you did a port span, you may have only spanned the Tx of the server switch port and not both Tx and Rx.

Can you provide any information on how you are capturing your data?

Rooster_50's avatar
254
Rooster_50
answered 2018-06-08 04:27:54 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Sure.

  1. Start Wireshark.exe
  2. Select inteface to capture traffic
  3. Capture has started and to filter the incoming data I use "ip.addr == xxxx.xxxx.xx.xx" as a display filter. (I know the DNS name, ping the server and get the ip address. ip.addr filter as I know gets the data where specified IP is used for source OR destination)
romario4's avatar romario4 (2018-06-08 10:30:40 +0000) edit
more
  • delete

"Start Wireshark.exe" on what? The server itself, or are you capturing from another machine? If from another machine, how are you capturing the data to/from the server? Port Span, TAP, L1 Hub, etc?

Rooster_50's avatar Rooster_50 (2018-06-09 05:26:57 +0000) edit
more
  • delete

Hm.. I am starting it on my local notebook. With default settings just choosing the interface (Ethernet #..) from the list. Start catching traffic and the filter it with display filter.

I believe there is no port span or tap. Not sure what is L1 Hub.

Just to make an analogy with Fiddler - you start the app, do your http things in the browser and see all the requests/responses there. My expectations were the same using wireshark :)

romario4's avatar romario4 (2018-06-09 06:10:40 +0000) edit
more
  • delete

Am I doing something wrong on the app start?

romario4's avatar romario4 (2018-06-11 12:17:41 +0000) edit
more
  • delete
add a comment see more comments
0

I think I found the answer... I uninstalled 2.6.1 version and installed - Old Stable Release (2.4.7) With 2.4.7 everything works and I see the requests (POST/GET/etc)

Bug in 2.6.1?

Thanks!

romario4's avatar
1
romario4
answered 2018-06-12 17:06:19 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer