Show only HTTP traffic in Wireshark

Question

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.

enter image description here

HTTP traffic usually *IS* TCP traffic; it's not as if HTTP and TCP are at the same network layer. The Protocol column just shows the topmost protocol layer Wireshark understands; if a TCP packet just has an ACK and no data, or Wireshark doesn't know how to dissect the data, it'll show it as TCP, but if it does know how to dissect it, it'll show that protocol. — , May 02 '14 at 21:41

score 34 · Accepted Answer · edited Jun 12 '20 at 13:48

34

In the filter field, type http (lowercase!). Tested with WireShark Portable 1.10.7

enter image description here

!http shows all traffic which is NOT http
ip.src != 196.168.1.1 shows traffic which is NOT from this IP source
ip.dst == 196.168.1.1 shows traffic to this IP destination
ip.addr == 196.168.1.1 shows all traffic which has the specific IP as source OR destination

edited Jun 12 '20 at 13:48

Community

answered May 01 '14 at 22:58

nixda

1

OK, it's working, but it shows both http and ssdp fields, which is strange. When I tried typing just "ssdp", it said no such protocol exists. – sashoalm May 01 '14 at 23:03
What wireshark version do you use? The wireshark wiki says, that [you cannot filter for SSDP](http://wiki.wireshark.org/SSDP). Workaround is `udp.dstport == 1900 && http` – nixda May 01 '14 at 23:03
Version 1.8.2. Also, when I typed "tcp" for filter, it showed TCP, TLSv1.1 and HTTP fields. – sashoalm May 01 '14 at 23:07
If you type "tcp" as the filter, it'll show all TCP traffic, whether it's HTTP running over TCP, SSL/TLS running over TCP, or something else running over TCP. – May 02 '14 at 21:42
what if you only see protocol: 0x0800 – SuperUberDuper Sep 17 '19 at 11:55
ie I want to filter by http and don't see it – SuperUberDuper Sep 17 '19 at 11:56

Johann · Answer 2 · 2015-04-07T20:17:15.583

5

To exclude SSDP/UDP: http && tcp

edited Apr 07 '15 at 20:17

answered Mar 19 '15 at 23:06

Johann

I have been trying to figure that one out for ages. Thanks! – Arnoud Buzing Apr 07 '15 at 20:10

score 1 · Answer 3 · answered Sep 15 '17 at 10:58

1

If you want to filter "ip address" and e.g. "http protocol" you have to input:

ip.src==192.168.109.217&&http

without spaces between.

answered Sep 15 '17 at 10:58

Bettelbursche

3 Answers3