Ethereal-users: Re: [Ethereal-users] Http packet capture

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 12 Dec 2003 13:10:59 -0800

On Dec 12, 2003, at 12:52 PM, Sarkar, Sudipta wrote:

How do I capture packets for a particular protocol on a non standard port.

Use that port in a capture filter, if you only want to capture that traffic.

But that's not what you're asking later - you're not asking how to *capture* that traffic (meaning how to get that traffic into a capture), you're asking how to get Ethereal to *decode* that traffic as that particular protocol, for which the answer is:

What I mean is I have a webserver running on port 8001 instead of 80. When I capture packets all HTTP traffic to and from that webserver from my machine (where ethereal is running) is being treated as TCP packets and not HTTP as webserver is not listening on port 80. So those packets are not decoded as HTTP packets. What do I need to do for ethereal to treat HTTP packets to and from port other that port 80 as HTTP and not just TCP.

...select one of the packets, select "Decode As..." from the "Tools" menu (or, for current CVS Ethereal, the "Analyze" menu), select from the option menu after "TCP" the appropriate port number (8001, in your case), select "HTTP" from the list of protocols, and click "OK".