Wireshark · Ethereal-users: [Ethereal-users] RE: http display filter wll not show http 1.1 packets

[Jürgen Kürpig <Juergen.Kuerpig@xxxxxxxxxx>]

Hi Jerry, Hi Olivier,

I added the alternate http port as suggested by Jerry. Now everthing is fine :-)

Thanks a lot,

Jürgen


Another possibility is that the HTTP/1.1 traffic is not being reassembled. A quick peek at your protocol preferences from within Ethereal will clarify on this... 
Best regards, 
Olivier
On 3/14/06, Jerry Talkington wrote: 
	On Tue, Mar 14, 2006 at 02:02:19PM +0100, Juergen Kuerpig wrote:
	> Hi,
	>
	> I'm using the current version Version 0.10.14 on windows and accessing pages via IE 6.0 with proxy configuration.
	> I analysing http traffic with any hosts in our LAN, but http display filter doesn't work properly.
	> Only packets are found related to GETs with HTtP 1.0.
	> Maybe the problem is that the GET for HTTP 1.1 doesn't include the protocol and the host in my case.
	> How can I achieve that the http display filter will view such HTTP 1.1 traffic? The two different cases are shown below from captured stream: 
	>
	> GET for HTTP/1.0 goes over proxy and is displayed.
	> GET http://<host>:<port>/xyz/index.html HTTP/1.0
	>
	> GET for HTTP/1.1 does not go over proxy (LAN) and is not displayed with http display filter. 
	> GET /xyz/index.html HTTP/1.1
	>
	> In captured stream I found out that is was captured and with tcp display filter I saw the packets but not with http display filter.
	> tcp filter is not a good workarround, because I want to analyse the http protocol for convenience. 
	> What I'm doing wrong?
	
	My guess would be that you are not using a port that's pre configured
	for http. Under the http preferences there's an option to add an
	alternate TCP port.