Wireshark-users: [Wireshark-users] How to see HTTP hosts visited
From: "Gary Fritz" <fritz@xxxxxxxx>
Date: Mon, 12 Nov 2007 09:39:38 -0600
I installed Wireshark to use as a parenting tool.  :-)  We just gave my 12-yr- old a hand-me-down laptop with wifi.  We have some net-nanny-type software on it to try to keep him on a rather short leash, but occasionally we have to turn it off to let him do homework/etc research.  I want to keep a clandestine eye on him while he does.  (He is a really good kid, but he once filled a computer with viruses while he was surfing for porn -- not appropriate for a kid!!  He needs some supervision and monitoring.  I want to keep an eye on what he does when "off the leash.")

So anyway.  I've figured out how to monitor packets.  If I look at my own system, I can filter on my IP, and I can even do a Statistics report (filtering on "ip.addr == 192.168.1.106  and  http") to find the HTTP hosts I'm  hitting.  So far so good, if a bit manual.

Problems:  I don't seem to get the http requests from his wifi connection on my hard-wired PC.  I get a few things like registration and ICMP requests, but I don't see HTTP requests.  Why some but not others?  Do I have to monitor his wifi connection from another wifi connection?

Also, the http Statistics report produces a lot more data than I want, no surprise.  E.g. if I browse to site A, which has graphics downloaded from sites B-Z, the report shows me requests for sites A-Z.

Is there any way to narrow the report down to ONLY the sites HE REQUESTS, either by typing in a URL or by clicking on a link?  And is there a better way to do this than the stumbling around I've done?

Thanks,
Careful Dad