0

I installed wireshark on ubuntu, run capture on "wlp2s0f0" and load some pages in browser. But when I enter filter http in wireshark, I don`t see anything. What I do wrong and how I can solve this problem?

Evgeniy
  • 121
  • There are two filter types in wireshark: display filters (at the top of the packet list after capturing), and capture filters (specified when you start the capture). Which one of those are you referring to there? – Jeremy Kerr May 12 '17 at 02:07
  • @Jeremy display filter – Evgeniy May 12 '17 at 02:53

1 Answers1

1

The value http seems to be a valid display filter, and a quick check here seems to work okay:

wireshark with display filter of http

So, perhaps something else is going on here. A couple of things to check:

  • Are you capturing on the correct interface? You can confirm which interface your request would be routed through, via ip route get <ip>
  • Do you see the HTTP requests in the unfiltered view?
  • Do you see any packets in the unfiltered view? By default, all captured packets should be displayed. If you see nothing (and you're sure there's network activity), you may be capturing on the wrong interface.
  • Are you sure that your browser is performing HTTP requests (on port 80), and not HTTPS?
Jeremy Kerr
  • 27,199
  • on "protocol" colunm i found only tcp, tlsv1.20 and mdns protocols – Evgeniy May 12 '17 at 14:34
  • Sounds like your browser is doing a HTTPS request, and not HTTP (the presence of tlsv1.20 would suggest this). Try loading a page from your browser by explicitly using a http:// prefix on the URL. – Jeremy Kerr May 13 '17 at 12:14
  • When i try load page using a http:// prefix it has been replaced by https:// – Evgeniy May 13 '17 at 17:33
  • Sounds like your browser is assuming you always want https. I'm not very familiar with Opera, can you configure it not to do that? – Jeremy Kerr May 15 '17 at 06:04