For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host contains tdc1. But it omits the responses and I have no idea how to add them.
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Nov 19, 2022 at 23:04
-
Unfortunately, no. The answer was not satisfying. And I have no way of knowing if there is a better answer without delving deep into it myself. Which I do not have the time now.– markNov 20, 2022 at 16:10
Add a comment
|
2 Answers
A somewhat practical method is to
- select one of the packets in question
- expand Transmission Control Protocol
- look for the [Stream index:
n] metatag - change or expand your filter to/with tcp.stream eq
n
Alternatively, you can just right-click the packet and select Follow → TCP Stream or hit Ctrl-Shift-Alt-T - this overwrites your current filter though.
You may have to filter on the requests and responses separately, then merge the pcap files.
answered Apr 15, 2022 at 20:27
-
-
-
How can I filter responses matching the filters? E.g. I can filter requests by the http.host field. But how can I get the respective responses?– markApr 16, 2022 at 4:44
-
-
I have captured HTTP traffic outgoing from my build agent. Some traffic goes to the Azure DevOps Server, some goes to other machines - has to do with the fact that the build agent is in Azure. I want to concentrate only on the traffic to the Azure DevOps Server - inspect the requests and their corresponding responses. I may further reduce the amount of "interesting" requests and would like to see their matching responses.– markApr 16, 2022 at 14:34