How to View Status Codes in Wireshark

Wireshark, the world’s most powerful network protocol analyzer, essentially monitors data packets sent over a computer’s network in real time. Since the inception of this open source tool in 1998, it has been developed and maintained by a global team of protocol and networking specialists.

If you need to investigate the status codes of data packets using Wireshark, we describe the steps to do so for HTTP requests. Additionally, our FAQ includes the meaning of each status code and some of the most common HTTP request methods with examples.

How to find the status code for an HTTP request in WireShark

To find the status code of a web server’s response to an HTTP request:

1. Start your Internet browser.
2. Clear your browser cache.
   
3. Start “Wireshark”.
   
4. From the list of network interfaces on your computer:
   • Double-click your Ethernet or Wi-Fi adapter.
     
   • Wireshark will start collecting packets automatically.
     
5. Launch a new web browser and then navigate to the website whose status codes you want to examine.
6. To view only HTTP packets, enter “HTTP” in the “Filter” text field at the top left.
   
7. Then, in the main menu, click the start icon (the first icon) to start capturing packets.
   
8. Refresh the page. Once Wireshark displays the HTTP packets for your website request, stop capturing by clicking the stop icon.
   
9. Select the package entry where the “Information” column says: “HTTP/1.1 [XXX a number] OK.”
   
10. The numerical part of the “Information” will be the status code.

Note: The status code and other useful information about the selected data packet are available in the window below the packet window. Expand the “Hypertext Transfer Protocol” option, then “HTTP/1.1…”. option below to view it.

How to view all status codes for an HTTP request

1. Start your Internet browser.
2. Clear your browser cache.
   
3. Start “Wireshark”.
   
4. From the list of network interfaces on your computer:
   • Double-click your Ethernet or Wi-Fi adapter.
     
   • Wireshark will start collecting packets automatically.
     
5. Launch a new web browser and then navigate to the website whose status codes you want to examine.
6. To view only HTTP packets, enter “HTTP” in the “Filter” text field at the top left.
   
7. Then, in the main menu, click the start icon (the first icon) to start capturing packets.
   
8. Refresh the page. Once Wireshark displays the HTTP packets for your website request, stop capturing by clicking the stop icon.
   
9. From the top menu, select “Statistics”, “HTTP” and then “Packet Counter”.
   
10. A filter window will appear. Leave the text field blank and click “Create Statistics.”
11. Click the plus sign next to the “HTTP Response Packets” option to expand it.
    
12. Expand the status code groupings to get more details for each status code.
    

Frequent questions

What do status codes mean in WireShark?

Status codes are responses given by the web server in response to a request made to it. Requests are made to web servers when browsing to a web page.[s] from your web browser and all other interactions you have with the website[s].

Can I filter status codes in WireShark?

To list status codes for HTTP requests only:

1. Start your Internet browser.

2. Clear your browser cache.

3. Start “Wireshark”.

4. From the list of network interfaces on your computer:

· Double-click your Ethernet or Wi-Fi adapter.

· Wireshark will start collecting packets automatically.

5. Start a new web browser, and then navigate to the website whose status codes you want to examine.

6. In the “Filter” text field at the top left, enter “http.response.code.”

7. Then, in the main menu, click the start icon (the first icon) to start capturing packets.

· Status codes for your web server requests will be displayed in the packet window.

What is the meaning of different HTTP response status codes?

HTTP status codes are pided into five categories. Each answer is made up of three digits; only the first digit describes the response category. The categories are:

• 1XX is an information response to say that the request has been received by the server and is being processed.

• 2XX is a success response to confirm that the request was successfully received, understood, and accepted.

• 3XX is a redirect message warning that further action is required before the request can be completed successfully.

• 4XX is a client error, issued when the request cannot be made.

• 5XX is a server error, for when the request is valid, but the server did not fulfill it.

Sniffing packets over the cable with Wireshark

Wireshark is an established open source packet analysis tool designed to capture Internet traffic running on your computer in real time. It has been developed over the years by a global team of talented and passionate specialists. It is an effective troubleshooting tool and helps get to the bottom of network problems, including downtime or malicious activity.

We show you how to view status codes when sending HTTP requests to a web server, how to filter them, and what they mean. What kind of answers and information did you find in your analysis? Were you able to use Wireshark to achieve what you wanted? Let us know what you think about the tool overall in the comments section below.