Configuring HTTP preferences

There are some preferences that you can change when working with HTTP. Let's see what they are.

Getting ready

Start Wireshark and go to the next section.

How to do it...

  1. Choose Edit | Preferences.
  2. Under Protocols, select HTTP. You will get the following window:
    How to do it...
    • By default, the upper four rows are checked. These are options that reassemble the HTTP headers and body when fragmentation is performed on the lower layers.
    • In the TCP Ports field, you will get a list of the port numbers that Wireshark will dissect as HTTP. In this list, you see the default port 80, ports 8080 and 8088 that are usually used for proxies, and others. In case you have an application working with HTTP with a port that is not listed, add it here.
    • The same with HTTPS—the default is 443 (that is for Secured HTTP, or HTTP over SSL/TLS). In case you use another port, add it here.

Custom HTTP headers fields

Custom HTTP headers fields enable us to create a new HTTP display filters under the http.header filter.

Let's look at the example in the following screenshot:

Custom HTTP headers fields

For creating a new HTTP display filter under the http.header filter, perform the following steps:

  1. In the HTTP preferences window (marked as 1 in the following screenshot), click on the Edit button in Custom HTTP headers fields.
    Custom HTTP headers fields
  2. Click on New (marked as 2 in the preceding screenshot).
  3. In Header name, enter the name of the filter to be used in extension to http.header (marked as 3 in the preceding screenshot).

    For example, if you want to configure a filter on the Age parameter, type the name Age in the Header name field (case sensitive!).

  4. In the Field desc field, type any description that will remind you what you have configured.

    For example, type Aging time of … (any description will do, it is just a note).

  5. Click on OK.
  6. In the Display Filter textbox, you will be able to use the http.header.Age filter.

    For example, you will be able to configure the display filter http.header.Age that contains 88482 that will give you all the packets with the Age field that contains the requested number

    Tip

    This filter configuration is mostly used when you are using proprietary parameters in the HTTP header, and you want to filter accordingly.

  7. You can configure many additional filters with this option.

How it works...

The reassembly feature is important because there are some cases in which IP fragmentation is used, and therefore the TCP message is also segmented. Marking the reassembly options simply tells the Wireshark to reassemble the monitored packets (what the receiver side is doing and therefore is able to understand it).

There's more...

Usually Wireshark shows dissected packets with port 80 as HTTP only if it sees a valid HTTP header. If you want to see all port 80 packets as HTTP, perform the following steps:

  1. Go to Preferences, and choose TCP in Protocols.
  2. Uncheck/disable Allow dissector to reassemble TCP streams.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.142.173.227