Wireshark-users: Re: [Wireshark-users] HTTP Header Order of Listing in WireShark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 27 Jul 2010 15:42:46 -0700
On Jul 27, 2010, at 2:58 PM, george_vandelet@xxxxxxxxx wrote:

> Since there are around 40 different http headers and they seem to be put in different orders by different applications, does the wireshark tool offer a reasonably simple  way to put them in some sort of order for analysis (other than the order in which they came on the wire)? 

Unfortunately, no.

What do you mean by "analysis"?  If it's not just "manually looking at the packets", you might be able to have a tap (which I think can be written in Lua, at least if your Wireshark build includes the Lua interpreter and it's enabled) that looks at the headers Wireshark knows about (a subset of all the possible headers - the top-of tree version knows about

        Authorization
        Proxy-Authorization
        Proxy-Authenticate
        WWW-Authenticate
        Content-Type
        Content-Length
        Content-Encoding
        Transfer-Encoding
        User-Agent
        Host
        Connection
        Cookie
        Accept
        Referer
        Accept-Language
        Accept-Encoding
        Date
        Cache-Control
        Server
        Location
        Set-Cookie
        Last-Modified
        X-Forwarded-For

as named fields) and not only sorts them but performs other processing to get you the ultimate answer you're looking for.