Re: filter for ONLY initial get request

["j.snelders" <j.snelders () telfort nl>]

Hi Jeffs,

Does this help you?
(http.request.method == "GET") &&  (http.request.uri contains "/")

My best
Joke

On Sun, 08 Aug 2010 12:22:02 -0400 Jeffs wrote:
> On 8/8/2010 3:04 AM, j.snelders wrote:
> > On Sun, 08 Aug 2010 01:20:35 -0500 David Alanis wrote:
> >    
> > > Quoting Jeffs<jeffs () speakeasy net>:
> > >
> > >      
> > > > On 8/8/2010 12:02 AM, David Alanis wrote:
> > > >        
> > > > > Quoting Jeffs<jeffs () speakeasy net>:
> > > > >
> > > > >          
> >    
> > > Not sure what your ultimate goal here is but give this filter a try as
> > >      
> >    
> > > it only displays the initial GET / HTTP/1.1 request and nothing else...
> > >
> > > http.request.uri == "/"
> > >
> > >      
> > ...also other http.request.methods, e.g. POST, will be displayed,
> >
> > so use
> > (http.request.method == "GET")&&  (http.request.uri == "/")

> >    
> Thank you!  that is very much what I am looking for.  Does wireshark 
> take regex expressions because after using your filter (which gets me 
> about 80% of what I need) I see there are many URLs which look like 
> this, which I would also like:
>
> www.domainname.com/landingpagelink
>
> and the http.request.uri == "/"
>
> will not capture those embedded links because of the trailing 
> "/landingpagelink"
>
> I'm wondering if some regex expression could help here.
>
> Thank you again for the expert advice!


       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe