Wireshark-users: Re: [Wireshark-users] HTTP filter

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Mon, 3 Jan 2011 12:08:10 -0700
On Mon, Jan 03, 2011 at 05:17:21PM +0900, Andrej van der Zee wrote:

> I was wondering how wireshark implements the HTTP filter. Does it just 
> look at the destination port only?

The display filter "http" displays all packets handled by the HTTP 
dissector.  The HTTP dissector will work on packets meeting one of these 
criteria:

 - One of the ports from the "TCP Ports" HTTP preference

 - One of the ports from the "SSL/TLS Ports" HTTP preference

 - Another dissector that uses HTTP on a different port such as IPP