Wednesday, March 30, 2016

Wireshark: Search for GET and POST requests

When analyzing a packet capture file (*.pcap) with Wireshark, it can be handy to view just the GET and POST requests.

To view GET requests, set display filter to:
http.request.method == "GET"

To view POST requests, set display filter to:
http.request.method == "POST"

To view both GET and POST requests, use the or operator:
http.request.method == "GET" or http.request.method == "POST"

No comments: