Wireshark-users: Re: [Wireshark-users] URL capture filer??
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 04 Feb 2008 15:57:16 -0800
jacob c wrote:
I just wanted/assumed Wireshark would read the http header for www.cnn.com <http://www.cnn.com> and then capture accordingly. 

No.
"host XXX" in libpcap/WinPcap (the library that Wireshark/TShark - and a *lot* of other software, including tcpdump/WinDump - uses to capture traffic) - means "traffic to or from the IPv4 address or the IPv6 address corresponding to XXX".
That requires that libpcap/WinPcap (and thus the application using it) resolve any host name given in "host XXX" expressions. 


Is there a way to do that if I am using a proxy?


No.