#WIRESHARK CAPTURE HTTP TRAFFIC FULL#

Observe the full HTTP response to be passed to the web browser.

Notice the Reassembled TCP Segments listed.

Observe the packet details in the middle Wireshark packet details pane.

Select the last HTTP packet, labeled HTTP 200 OK.

Notice that for every two TCP segments of data, there is a TCP ACK acknowledgement of receiving the HTTP response.

Observe the traffic captured in the top Wireshark packet list pane.

Observe the packet contents in the bottom Wireshark packet bytes pane.

Notice that because the server response is longer than the maximum segment PDU size, the response has been split into several TCP segments.

Select the next packet, labeled TCP segment of a reassembled PDU.

This is the server TCP acknowledgement of receiving the GET request.Īctivity 7 - Analyze HTTP Response Traffic

Select the next packet, labeled TCP ACK.

Notice that the request is similar to the request in Activity 4 above, except that the new page location is requested.

Select the third HTTP packet, labeled GET /wiki/Wikiversity:Main_Page.

This is the client TCP acknowledgement of receiving the HTTP response.Īctivity 6 - Analyze HTTP Request Traffic This response indicates that the requested page has permanently moved to the location provided.

Observe the HTTP response, Server, Expires, Location, and other available information.

Select the second HTTP packet, labeled 301 Moved Permanently.

This is the server TCP acknowledgement of receiving the GET request.Īctivity 5 - Analyze HTTP Response Traffic

Select the fifth packet, labeled TCP ACK.

This is the information passed to the HTTP server with the GET request.

Observe the GET request, Host, Connection, User-Agent, Referrer, Accept, and Cookie fields.

Expand Hypertext Transfer Protocol to view HTTP details.

Also notice that the Ethernet II, Internet Protocol Version 4, and Transmission Control Protocol values are consistent with the TCP connection analyzed in Activity 3. Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol / Hypertext Transfer Protocol frame.

Select the fourth packet, which is the first HTTP packet and labeled GET /.

#WIRESHARK CAPTURE HTTP TRAFFIC MAC#

Note that all of the packets for this connection will have matching MAC addresses, IP addresses, and port numbers.Īctivity 4 - Analyze HTTP Request Traffic

Notice that it is a dynamic port selected for this HTTP connection.

Expand Transmission Control Protocol to view TCP details.

Notice that the destination address is the IP address of the HTTP server. Notice that the source address is your IP address.

Expand Internet Protocol Version 4 to view IP details.

You can use ipconfig /all and arp -a to confirm. The destination should be your default gateway's MAC address and the source should be your MAC address.

Observe the Destination and Source fields.

Expand Ethernet II to view Ethernet details.

Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol frame. The first three packets (TCP SYN, TCP SYN/ACK, TCP ACK) are the TCP three way handshake.

To view all related traffic for this connection, change the filter to ip.addr =, where is the destination address of the HTTP packet.Īctivity 3 - Analyze TCP Connection Traffic.

Select the first HTTP packet labeled GET /.

To view only HTTP traffic, type http (lower case) in the Filter box and press Enter.

Navigate to the website found in your search.Īctivity 2 - Select Destination Traffic.

Search the Internet for an http (rather than https) website.

#WIRESHARK CAPTURE HTTP TRAFFIC HOW TO#

These activities will show you how to use Wireshark to capture and analyze Hypertext Transfer Protocol ( HTTP) traffic.Īctivity 1 - Capture HTTP Traffic

#WIRESHARK CAPTURE HTTP TRAFFIC FREE#

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. 9 Activity 7 - Analyze HTTP Response Traffic.8 Activity 6 - Analyze HTTP Request Traffic.7 Activity 5 - Analyze HTTP Response Traffic.6 Activity 4 - Analyze HTTP Request Traffic.5 Activity 3 - Analyze TCP Connection Traffic.4 Activity 2 - Select Destination Traffic.

Wireshark capture http traffic