Wireshark-users: Re: [Wireshark-users] filter for ONLY initial get request
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeffs <jeffs@xxxxxxxxxxxxx>
Date: Sun, 08 Aug 2010 12:22:02 -0400
On 8/8/2010 3:04 AM, j.snelders wrote:

On Sun, 08 Aug 2010 01:20:35 -0500 David Alanis wrote:

Quoting Jeffs<jeffs@xxxxxxxxxxxxx>:


On 8/8/2010 12:02 AM, David Alanis wrote:

Quoting Jeffs<jeffs@xxxxxxxxxxxxx>:


Not sure what your ultimate goal here is but give this filter a try as

it only displays the initial GET / HTTP/1.1 request and nothing else...

http.request.uri == "/"


...also other http.request.methods, e.g. POST, will be displayed,

so use
(http.request.method == "GET")&&  (http.request.uri == "/")

Best regards
Joke




___________________________________________________________________________
Sent via:    Wireshark-users mailing list<wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
Thank you! that is very much what I am looking for. Does wireshark take regex expressions because after using your filter (which gets me about 80% of what I need) I see there are many URLs which look like this, which I would also like: 

www.domainname.com/landingpagelink

and the http.request.uri == "/"
will not capture those embedded links because of the trailing "/landingpagelink" 

I'm wondering if some regex expression could help here.

Thank you again for the expert advice!