0

I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.

Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:

enter image description here

My Wireshark preferences:

enter image description here

I used Linux mint 17

ifconfig:

wlp2s0    Link encap:Ethernet  HWaddr 44:03:2c:de:e9:3c  
          inet addr:192.168.1.100  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::affa:82b5:848f:52f3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:390931 errors:0 dropped:0 overruns:0 frame:0
          TX packets:268403 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:458918735 (458.9 MB)  TX bytes:39776473 (39.7 MB)

in Wireshark, I choosed wpl2s0 also.

5
  • 2
    I see TLS connections to port 443, that would be https, but since it's encrypted, wireshark can't look at the contents directly. – Ulrich Schwarz Jan 27 '19 at 19:57
  • @UlrichSchwarz, thanks, it is useful information. But, how to resolve this? – Valentyn Hruzytskyi Jan 27 '19 at 20:01
  • 1
    The premise of the question is wrong, it is not a Unix problem you do not knowing your TCP/IP or the difference between HTTP and HTTPS. You also are not very clear which HTTP/S connections are, or where they go/come from. – Rui F Ribeiro Jan 27 '19 at 20:27
  • @RuiFRibeiro, thanks. At the moment, I am closer to understanding this issue. So, I have to look for SSL instead of http? – Valentyn Hruzytskyi Jan 27 '19 at 20:31
  • 1
    10th line, 3rd column, are you seeing it in your image? Look for HTTPS/443/TLS. – Rui F Ribeiro Jan 27 '19 at 20:36
2

As mentioned in the comments, the port number 443 suggests HTTPS, and so SSL/TLS is in effect. However, Wireshark can decrypt SSL/TLS if given the necessary keys.

The required key depends on the encryption algorithm used. If the selected algorithm uses RSA and not DH (i.e. the OpenSSL-style algorithm name string includes RSA and does not include DHE), then Wireshark can decrypt the traffic if you can supply it the private key of the server's certificate.

If the DH algorithm is used, each session has an individual session key. In that case, you'll need to configure one connection endpoint to log the TLS session keys used, and then pass the logged keys to Wireshark. For Firefox or Chrome browsers, the session keys can be logged simply by adding a SSLKEYLOGFILE=<full pathname to the log file> environment variable before starting the browser.

The procedure is a bit complex to describe here, but there is a complete walkthrough on SSL/TLS capture and decryption in the Wireshark documentation.

Also, the Information Security.SE has a good question + answer about this topic here. And here's another detailed walk-through of the procedure.

2
  • One short question for you: can I saw the GET/POST methods if I will learn this question? (I try to saw the difference between GET/POST methods in http and https protocols) – Valentyn Hruzytskyi Jan 27 '19 at 20:59
  • 1
    Yes, once the SSL/TLS layer is successfully decrypted, the methods used will be visible in the capture output, just like they are with plain HTTP. – telcoM Jan 27 '19 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.