How to capture HTTP traffic in Wireshark

Wireshark allows you to analyze traffic within your network with several tools. If you want to see what’s happening within your network or are having issues with network traffic or page loading, you can use Wireshark. It allows you to capture the traffic, so you can understand what the problem is or send it to support for further help. Continue reading this article and you will learn how to capture http traffic in Wireshark.

Installing Wireshark

Installing Wireshark is a simple process. It is a free tool on different platforms and this is how you can download and install it:

Windows and Mac users

1. Open your browser.
2. Visit https://www.wireshark.org/download.html.
3. Select the version for your device.
   
4. Wireshark will download to your device.
5. Install it following the instructions on the package.
   

Linux users

If you are a Linux user, you can find Wireshark in the Ubuntu Software Center. Download it from there and install it according to the instructions on the package.

Capturing HTTP traffic in Wireshark

Now that you have installed Wireshark on your computer, we can continue with capturing http traffic. These are the steps to do it:

1. Open your browser: you can use any browser.
2. Clear cache: Before capturing traffic, you must clear your browser’s cache. You can do this by going to your browser settings.
   
3. Open Wireshark.
   
4. Tap “Capture.”
   
5. Tap “Interfaces.” Now you will see a pop-up window on your screen.
6. Choose the interface. You probably want to analyze the traffic passing through your Ethernet controller.
   
7. Once you have selected the interface, tap “Home” or tap “Ctrl + E.”
   
8. Now go back to your browser and visit the URL from which you want to capture traffic.
   
9. Once you’re done, stop capturing traffic. Go back to Wireshark and tap “Ctrl + E.”
   
10. Save the captured traffic. If you have network problems and want to send the captured traffic to support, save it in a file in *.pcap format.
    

Capturing packets in Wireshark

In addition to capturing http traffic, you can capture any network data you need in Wireshark. Here’s how you can do this:

1. Open Wireshark.
   
2. You’ll see a list of available network connections that you can browse. Select the one that interests you. If you want, you can scan multiple network connections at once by pressing “Shift + left click”.
   
3. Now you can start capturing packets. You can do this in several ways: the first is by tapping the shark fin icon in the top left corner. The second is to tap “Capture” and then tap “Start.” The third way to start capturing is by tapping “Ctrl + E.”
   

While capturing, Wireshark will display all captured packets in real time. Once you are done capturing packets, you can use the same buttons/shortcuts to stop capturing.

Wireshark Filters

One of the reasons why Wireshark is one of the most famous protocol analyzers today is its ability to apply various filters to captured packets. Wireshark filters can be pided into capture and display filters.

Capture filters

These filters are applied before capturing data. If Wireshark captures data that does not match the filters, it will not be saved and you will not see it. So if you know what you’re looking for, you can use capture filters to narrow your search.

Here are some of the most commonly used capture filters that you can use:

• host 192.168.1.2 – Captures all traffic associated with 192.168.1.2.
• port 443 – Captures all traffic associated with port 443.
• port no 53 – Captures all traffic except that associated with port 53.

Display filters

Depending on what you are analyzing, your captured packets can be very difficult to review. If you know what you are looking for or if you want to limit your search and exclude data you don’t need, you can use display filters.

Here are some of the display filters you can use:

• http: If you have captured several different packets, but want to see only http-based traffic, you can apply this display filter and Wireshark will show you only those packets.
• http.response.code == 404 – If you are having trouble loading certain web pages, this filter may be helpful. If you apply it, Wireshark will only show packets where “404: Page not found” was a response.

It is important to keep in mind the difference between capture and display filters. As you have seen, it applies capture filters before and displays filters after capturing packets. With capture filters, you discard all packets that do not fit the filters. With display filters, you do not drop any packets. It simply hides them from the list in Wireshark.

Additional Wireshark Features

Although capturing and filtering packets is what Wireshark is famous for, it also offers different options that can make filtering and troubleshooting easier, especially if you are new to this.

Colorization option

You can color packages in the Package List based on different display filters. This allows you to emphasize the packets you want to analyze.

There are two types of coloring rules: temporary and permanent. Temporary rules apply only until you close the program, and permanent rules are saved until you change them again.

You can download examples of coloring rules. hereor you can create your own.

promiscuous mode

Wireshark captures traffic arriving or leaving the device it is running on. By enabling promiscuous mode, you will be able to capture most of the traffic on your LAN.

command line

If you are running your system without a GUI (graphical user interface), you can use Wireshark’s command line interface. You can capture packets and review them in a GUI.

Statistics

Wireshark offers a “Statistics” menu that you can use to analyze captured packets. For example, you can view file properties, analyze traffic between two IP addresses, etc.

Frequent questions

How do I read captured data in WireShark?

Once you’re done capturing packets, Wireshark will display them all in a packet list panel. If you want to focus on a specific capture, double click on it and you can read more information about it.

You may decide to open a particular snapshot in a separate window for easier analysis:

1. Choose the package you want to read.

2. Right click on it.

3. Tap “View.”

4. Tap “Show package in new window”.

Here are some details from the packet list panel that will help you with reading traps:

1. No.: the number of a captured packet.

2. Time – This shows you when the packet was captured relative to when you started capturing it. You can customize and adjust the value in the “Settings” menu.

3. Source: This is the origin of a packet captured in the form of an address.

4. Destination: The destination address of a captured packet.

5. Protocol: The type of packet captured.

6. Length: This shows the length of a captured packet. This is expressed in bytes.

7. Information: Additional information about a captured packet. The type of information you see here depends on the type of packet captured.

All of the above columns can be reduced with the use of display filters. Depending on what interests you, you can interpret Wireshark captures more easily and quickly by applying different filters.

In a world of fish, be a Wireshark

You have now learned how to capture http traffic in Wireshark, along with useful information about the program. If you want to inspect your network, troubleshoot, or make sure everything is in order, Wireshark is the right tool for you. It is easy to use and interpret and is free.

Have you used Wireshark before? Tell us in the comments section below.