Wireshark — HTTP & Traffic Analysis

Wireshark uses two different filtering systems. Capture filters decide which packets are collected, while display filters decide which already captured packets are shown. Most interactive analysis inside Wireshark uses display filters.

The http protocol filter displays packets decoded by Wireshark as HTTP. More specific fields can then be used to isolate requests, responses, hosts, methods or status codes.

HTTP response codes are useful for finding successful requests, redirects, authentication failures and server errors.

Filtering by method quickly separates browsing activity, submitted forms, uploaded data and other request types.

HTTP host and URI fields are especially useful when the capture contains traffic to many websites or endpoints.

URI filtering can quickly reveal downloads or requests involving scripts, documents, executables and archives.

frame contains performs a broad search through packet data for a value. It is useful when the exact protocol field is unknown, although protocol-specific filters are usually cleaner and faster.

The contains operator checks whether a field includes a particular value. It is very useful for strings such as URIs, hostnames, User-Agent values and DNS names.

The User-Agent identifies the client software presented to the HTTP server. It can reveal browsers, operating systems, command-line tools, scripts and automated clients.

HTTP header fields can reveal client behaviour, server software, authentication information, cookies and content types.

The && operator means AND. Both conditions must be true. Combining protocol fields is one of the fastest ways to reduce large captures.

The || operator means OR. It is useful when several values should be included in the same view.

The ! operator excludes matching traffic. This is useful for removing noisy protocols or known hosts.

IP filters are essential when following traffic associated with a particular client or server.

Port filters are useful when a protocol is running on a non-standard port or when Wireshark cannot automatically decode it.

DNS filters help identify which domains a system queried and which addresses were returned. This is one of the fastest ways to understand external communication in a capture.

DNS query types can isolate address lookups, IPv6 lookups, mail servers or other record types.

SMB2 filters help analyse Windows file-sharing activity, authentication-related traffic and access to network shares.

SMB2 commands represent operations such as session creation, tree connections, file creation, reads and writes. Filtering by command can reduce a large SMB capture to a particular operation.

Filtering by tcp.stream isolates all packets belonging to one TCP conversation. This is one of the most useful techniques when analysing application traffic.

Follow TCP Stream reconstructs the application conversation carried inside a TCP connection. Right-click a TCP packet and select Follow → TCP Stream. Wireshark then displays the client-to-server and server-to-client data together in the order in which it was transmitted.

It is especially useful for reconstructing HTTP requests and responses, reading plaintext protocols, reviewing submitted parameters, seeing downloaded content and understanding a conversation without inspecting each packet individually.

For HTTP traffic, Wireshark may also provide Follow → HTTP Stream. This focuses on HTTP-layer data while Follow TCP Stream reconstructs the underlying TCP connection.

In the Follow Stream window, Wireshark normally uses different colours to distinguish each direction of the conversation. One colour represents client-to-server data and the other represents server-to-client data.

When a TCP stream is followed, Wireshark automatically generates a tcp.stream filter. Closing the stream window often leaves that filter applied, making it easy to inspect the individual packets that formed the reconstructed conversation.

Ctrl + F opens Wireshark packet search. The search can operate against different parts of the capture depending on what you are trying to find.

Packet List searches the text visible in the main packet list columns, such as Source, Destination, Protocol, Length and Info. It is useful when searching for something already visible in the summary column.

Packet Details searches decoded protocol fields shown in the middle pane. This is useful when looking for field names, protocol values or decoded headers.

Packet Bytes searches the raw data represented in the packet bytes pane. This is useful when searching for strings that may not have been decoded into a dedicated Wireshark field.

The Find Packet dialog can search for text strings, hexadecimal byte sequences or display-filter expressions. Text is useful for names and URIs, while hexadecimal searches are useful when looking for known byte patterns.

Display filters are better when the protocol field is known because they reduce the entire packet list to matching traffic. Ctrl + F is better when you want to jump through occurrences without changing the current view or when the exact protocol field is unknown.

TCP analysis filters help identify retransmissions, resets and repeated connection attempts.

A SYN packet without the ACK flag normally represents the beginning of a TCP connection attempt. This filter provides a quick overview of connection targets.

ICMP is useful for identifying ping traffic and network errors.

ARP traffic maps IPv4 addresses to MAC addresses on the local network and can help identify local hosts and address resolution activity.

Plain HTTP traffic may expose form parameters, cookies, authentication headers or other application data because HTTP itself does not provide encryption.

HTTP traffic can normally be inspected directly because application data is plaintext. HTTPS uses TLS encryption, so HTTP fields are generally unavailable unless Wireshark has the necessary session keys to decrypt the traffic.

Even when encrypted payloads cannot be inspected, TLS metadata can still reveal useful information such as handshake activity and server names.

DHCP traffic can reveal host configuration activity, assigned addresses and network infrastructure information.

Combining ip.addr conditions isolates traffic exchanged between two systems regardless of direction.

A practical workflow is to first identify the hosts involved, then inspect DNS queries, look at new TCP connections, filter the relevant application protocol, identify interesting requests or filenames and finally reconstruct important TCP streams.

These filters are useful when quickly reviewing an unfamiliar packet capture.

Use == for exact equality, != for inequality, contains for substring matching, && for AND, || for OR and ! for negation. Parentheses help keep complex filters readable.

Use protocol fields whenever possible instead of broad frame searches. Use Ctrl + F when you want to jump to specific text or bytes without changing the packet view. Use tcp.stream to isolate a TCP conversation and Follow TCP Stream to reconstruct it. DNS often reveals where a host is communicating, HTTP reveals application requests and SMB2 reveals Windows file-sharing activity.