Wireshark · Ethereal-users: Re: [Ethereal-users] http display filter wll not show http 1.1 packets

["Olivier Biot" <obiot.ethereal@xxxxxxxxx>]

Another possibility is that the HTTP/1.1 traffic is not being reassembled. A quick peek at your protocol preferences from within Ethereal will clarify on this...

 

Best regards,

 

Olivier
 

On 3/14/06, Jerry Talkington wrote:

On Tue, Mar 14, 2006 at 02:02:19PM +0100, Juergen Kuerpig wrote:
> Hi,
>
> I'm using the current version Version 0.10.14 on windows and accessing pages via IE 6.0 with proxy configuration.
> I analysing http traffic with any hosts in our LAN, but http display filter doesn't work properly.
> Only packets are found related to GETs with HTtP 1.0.
> Maybe the problem is that the GET for HTTP 1.1 doesn't include the protocol and the host in my case.
> How can I achieve that the http display filter will view such HTTP 1.1 traffic? The two different cases are shown below from captured stream:
>
> GET for HTTP/1.0 goes over proxy and is displayed.
> GET http://<host>:<port>/xyz/index.html HTTP/1.0
>
> GET for HTTP/1.1 does not go over proxy (LAN) and is not displayed with http display filter.
> GET /xyz/index.html HTTP/1.1
>
> In captured stream I found out that is was captured and with tcp display filter I saw the packets but not with http display filter.
> tcp filter is not a good workarround, because I want to analyse the http protocol for convenience.
> What I'm doing wrong?

My guess would be that you are not using a port that's pre configured
for http.  Under the http preferences there's an option to add an
alternate TCP port.