How do I view HTTP in Wireshark?

How do I filter a URL in Wireshark?

After I have logged into my VPN tunnel on my home network, Wireshark shows me all of the traffic that has gone over the VPN.

However, how do I filter only traffic from a specific URL? My goal is to log packets from a certain web site in Wireshark, so that if a hacker tries to get access to that site, we can see what he has done and stop him.

The filter syntax is fairly easy to find in Wireshark's manual.

How do I find the URL in Wireshark capture?

How do I find the source/destination addresses in Wireshark capture?

First of all the way you are capturing does not match with your problem description - you have a capture from which is has been filtered on the specific field. In that case use tcpdump and select just the traffic containing this particular TCP packet from interface eth0 : tcpdump -i eth0 'src host 10.10 or dst host 10.10' -vvv
Or simply tcpdump -n -i eth0 host 10.10 If you want to select only specific source/destination IP/host address you can set your capture filter to tcp.srcport = 80 and tcp.dstport = 80 for example.

To get source/destination IP/host addresses from packets captured by Wireshark, in order to see such fields we must use 'tcp.sport/dport', therefore in your example 'tcp.

How do I view HTTP in Wireshark?

I am in Windows Vista.

I ran Wireshark, and the "Filter: HTTP" option appeared as an option, so I opened the filter, clicked the "OK" button, but the interface did not update. The interface displayed all the traffic that I have filtered for, but it did not display any HTTP traffic.

You'll need to add a source for which the HTTP protocol is present on. That probably means creating a new capture filter with HTTP present as a filter on it.

For example, you could create a new filter using tcp.port == 80 on eth0. That would only look at traffic to the www.google.com domain that's on port 80.

Once you create the capture filter, you can view it by opening wireshark, clicking File->Open Capture. (or hitting F5 if it's already open).