Wireshark-users: Re: [Wireshark-users] URL capture filer??

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 04 Feb 2008 15:57:16 -0800

jacob c wrote:

I just wanted/assumed Wireshark would read the http header for www.cnn.com <http://www.cnn.com> and then capture accordingly.

No.

"host XXX" in libpcap/WinPcap (the library that Wireshark/TShark - and a *lot* of other software, including tcpdump/WinDump - uses to capture traffic) - means "traffic to or from the IPv4 address or the IPv6 address corresponding to XXX".

That requires that libpcap/WinPcap (and thus the application using it) resolve any host name given in "host XXX" expressions.

Is there a way to do that if I am using a proxy?

No.