Why Wireshark display filter does not show http packets?

http networking tcp wireshark packet-sniffers
Pranit Kothari picture Pranit Kothari · Nov 8, 2013 · Viewed 17.8k times · Source

When I use display filter for HTTP it shows only HTTP packets when HTTP message is on standard port i.e. on port 80. But, when message is not using standard port, then display filter not works for HTTP and I need to filter for TCP and then need to find out HTTP packets manually.

I want to know why this happen? Is it standard behavior or I am doing (or expecting) it wrongly.

Thanks.

Answer

War Gravy picture War Gravy · Dec 10, 2014

I had to enable the HTTP protocol by doing the following:

"Analyze -> Enabled Protocols"

This solution was for version 1.12.2 (and disabled by default in version 2.0.2) but should work for any variant of version 1 and 2.

Related questions

how to reassemble tcp segment?

im now developing a project using winpcap..as i have known packets being sniffed are usually fragmented packets. how to reassemble this TCP segements?..any ideas, suggestion or tutorials available?.. this i assume to be the only way i can …

Read More
How does HTTP2 solve Head of Line blocking (HOL) issue

How does HTTP2 solve Head of Line blocking (HOL) issue? This problem is very frequent in http1.1, but I heard HTTP2 has fixed this problem. Could someone explain how exactly HTTP2 fixed the problem?

Read More
Do firewalls block non-HTTP traffic on port 80?

Can anyone confirm that using a persistent outgoing TCP connection on port 80 will not be blocked by the vast majority of consumer firewalls? That has been assumption based on the fact that HTTP runs over TCP, but of course it …

Read More