Save only relevant traffic (5 packets) and exclude the unwanted traffic (397 packets). Number2 - relevant number of packets on interface of Step-4 : save packets Number1- total number of packets captured on interface Instead of “http contains “Google”” please Enter “ip.addr = 104.26.11.240” without double quotes.Īnd hit the enter key, your red filter Colour become green & you can see at the bottom In your case, open cmd prompt (windows user) and Nslookup your URL to find the ip address

To use a display filter with tshark, use the -Y display filter. For HTTP, you can use a capture filter of: tcp port 80 or a display filter of: tcp.port 80 or: http Note that a filter of http is not equivalent to the other two, which will include handshake and termination packets. To apply correct filter, you should know the public IP address or port (or both). Display filters allow you to use Wiresharks powerful multi-pass packet processing capabilities. Stop Wireshark packet capture, and enter http in the display-filter-specification window. (Refer below video for detail information: html Type the requested user name and password into the pop up box.

Note that straight line next to interface means no active traffic on that interface. If you are confused with many options, please remove unwanted connected devices to reduce the options, also open any YouTube video so that you can see the traffic fluctuation on your internet link interface. If you are using wireless router to connect internet, then select the Wi-fi: en0 option.

You need to choose the interface you're sniffing data from.

Wireshark filter by url