It seems like a simple filter, but I don't find anything about it on StackExchange or Google itself, nor could I accomplish this myself (only part of it).

What I have now is following:

http.request.method == "GET" or http.request.method == "POST"

I just want to display HTTP requests (works), but only with comments I made myself on some packets.

How should I configure the filter to work like that?

  • Even though you tagged the question with Wireshark, please remember to add what you are troubleshooting in your question. I added it to the subject. – user36472 Mar 15 '18 at 12:58
  • @Cown Thank you for reminding me, I'll do it the next time then :) – Fusseldieb Mar 15 '18 at 13:20
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 23:04
  • @RonMaupin Oh sorry, I've almost forgotten to do that... – Fusseldieb Apr 2 '18 at 11:32

For anyone that has the same question, I just tackled following together and it works just fine:

(http.request.method == "GET" or http.request.method == "POST") and pkt_comment

You need to know how IP Stack works before you can understand how to look for something you want.

Browser -> DNS Request -> IP Address Reply -> "Send HTTP Request"

You are in the Send HTTP Request Stage.

  • 2
    I'm afraid that you haven't understood the question. The comment has nothing to do with the packet. It is the Wireshark comment section, where you can include things like what a specific packet does, etc – Fusseldieb Mar 16 '18 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.