How to get HTTP request from Wireshark?

I'm a newbie in Wireshark and I'd like to know to parse it.

I saw one topic about how to get it but the link of the document is dead. How can I get it?

Wireshark supports a protocol analyzer, so you don't need to write the code yourself. If you are able to use a GUI-based interface like Wireshark or tshark, that's even better.

As I know, Wireshark supports capturing packets from a remote host. But in your case, you need to do the capturing yourself because you want to capture HTTP request from remote host. So, I think the only way is to capture packet by packet.

Can Wireshark capture a HTTPS URL?

I have been trying to figure this out for a while, but I am not having any luck. I have tried a couple of guides on the forums and google, but can't get anything to work.

1 Answer.
Yes, you should be able to. However, you may want to use one of the various libpcap based solutions to capture HTTPS traffic as it does not do a TLS/SSL handshake and therefore will not appear as a TCP connection.

If you are interested in capturing SSL encrypted traffic then I recommend using which is available for Mac OSX and Linux. This is the easiest solution for capturing HTTPS traffic because it is based on libpcap and thus it does not require any extra libraries or tools. It also supports tunneling so that you can actually see the traffic being sent over the network.

Wireshark is a tcp/ip protocol analyzer, it can analyse and decode all kinds of data transfers, not only tcp/ip, but udp/ip too. User4123Dec 16 '10 at 12:53. @user4123 Wireshark is limited to viewing the raw packet data. If you wish to decode the packets into something human readable, then you'll need to download a different application.

JamesDec 16 '10 at 14:26. You might want to look into tshark, but I haven't really used that myself. If you're willing to compile from source I'd be interested in knowing how it performs.

User4123Dec 17 '10 at 11:22. 1

@Andrew: In particular it might help if you would provide a sample link which Wireshark doesn't display correctly, it looks like your link is an " It is quite important that you remove the trailing "s". RaphaelJun 19 '11 at 1:01. I tested on Debian lenny (Wireshark 2.0). I compiled Wireshark and created the Wireshark file. After I set capture on a site I was able to view the plain-text http-traffic just fine.