HTTP

HTTP is an application layer protocol used in WWW. HTTP enables communications between the HTTP client and HTTP server. Example traffic is shown in the following screenshot. An HTTP GET request is created by the client (browser or cURL), and the HTTP server has responded with the appropriate content type:

HTTP Wireshark filter

Use http to display HTTP packets only. Use TCP port 80 to filter for HTTP traffic only; port 80 is the default HTTP port.

HTTP use cases

The following example shows different use cases where Wireshark can help to analyze HTTP packets.

Finding the top HTTP response time

Open the file http_01.pcap in the Wireshark, and find the top HTTP response time for the request HTTP get:

Click on Edit | Preferences | Protocols | TCP, uncheck Allow subdissector to reassemble TCP streams. This will help in knowing how many continuation packets there are to get the actual content and it will help in fine-tuning TCP parameters—for example, setting up the TCP window size to reduce the continuation packet.
In the Filter bar, apply the http filter and add http.time as a column from the http.response.code == 200 HTTP OK packet.
Click on the Time since request column and make it in descending order. Find the request frame and click on the link.

Finding packets based on HTTP methods

Use Wireshark's http.request.method to display packets for analysis. For example, the following table describes how to apply this filter:

HTTP method	Meaning	Wireshark filter
`GET`	Get a specified resource example: `GET http://www.w3.org/pub/WWW/TheProject.html HTTP/1.1`	`http.request.method=="GET"`
`POST`	Submits data to be processed to a specified resource	`http.request.method=="POST"`
`PUT`	Uploads a representation of the specified URI	`http.request.method=="PUT"`
`DELETE`	Deletes the specified resource/entity	`http.request.method=="DELETE"`
`OPTIONS`	Returns the HTTP methods that the server supports	`http.request.method=="OPTIONS"`
`CONNECT`	Converts the request connection to a transparent TCP/IP tunnel	`http.request.method=="CONNECT"`

Finding sensitive information in a form post

If the form contains sensitive information such as password, Wireshark can easily reveal it as HTTP is an unsecure means of transferring data over the network.

Open the HTTP_FORM_POST.pcap file and filter the traffic to display only the request method POST and locate the password form item, as shown in the following screenshot:

Finding sensitive information in a form post

Using HTTP status code

The first line of the HTTP response contains the status code. Use the Wireshark filter http.response.code, to display packets based on the status code. This will be helpful when debugging the HTTP client-server interaction:

Type	Code	Meaning	HTTP Wireshark filter
Informational – 1xx	100	Continue	`http.response.code == 100`
Informational – 1xx	101	Switching protocol	`http.response.code == 101`
Successful – 2xx From: 200 To: 206	200	OK	`http.response.code == 200`
Successful – 2xx From: 200 To: 206	201	Created	`http.response.code == 201`
Redirection – 3xx From: 300 To: 307	300	Multiple choices	`http.response.code == 300`
Redirection – 3xx From: 300 To: 307	301	Moved permanently	`http.response.code == 301`
Client Error – 4xx From: 400 To: 417	400	Bad Request	`http.response.code == 400`
Client Error – 4xx From: 400 To: 417	401	Unauthorized	`http.response.code == 401`
Server Error – 5xx From—500 To-- 505	500	Internal Server Error	`http.response.code == 500`
Server Error – 5xx From—500 To-- 505	501	Not implemented	`http.response.code == 501`

Table of Contents for Packet Analysis with Wireshark