Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] filter for ONLY initial get request

From: "j.snelders" <j.snelders@xxxxxxxxxx>
Date: Mon, 9 Aug 2010 17:17:58 +0200
Hi Jeffs,

Does this help you?
(http.request.method == "GET") &&  (http.request.uri contains "/")

My best
Joke

On Sun, 08 Aug 2010 12:22:02 -0400 Jeffs wrote:
>On 8/8/2010 3:04 AM, j.snelders wrote:
>> On Sun, 08 Aug 2010 01:20:35 -0500 David Alanis wrote:
>>    
>>> Quoting Jeffs<jeffs@xxxxxxxxxxxxx>:
>>>
>>>      
>>>> On 8/8/2010 12:02 AM, David Alanis wrote:
>>>>        
>>>>> Quoting Jeffs<jeffs@xxxxxxxxxxxxx>:
>>>>>
>>>>>          
>>    
>>> Not sure what your ultimate goal here is but give this filter a try as
>>>      
>>    
>>> it only displays the initial GET / HTTP/1.1 request and nothing else...
>>>
>>> http.request.uri == "/"
>>>
>>>      
>> ...also other http.request.methods, e.g. POST, will be displayed,
>>
>> so use
>> (http.request.method == "GET")&&  (http.request.uri == "/")

>>    
>Thank you!  that is very much what I am looking for.  Does wireshark 
>take regex expressions because after using your filter (which gets me 
>about 80% of what I need) I see there are many URLs which look like 
>this, which I would also like:
>
>www.domainname.com/landingpagelink
>
>and the http.request.uri == "/"
>
>will not capture those embedded links because of the trailing 
>"/landingpagelink"
>
>I'm wondering if some regex expression could help here.
>
>Thank you again for the expert advice!