Display Filter Reference: Hypertext Transfer Protocol

Protocol field name: http

Versions: 1.0.0 to 2.2.7

Back to Display Filter Reference

Field name Description Type Versions
http.accept Accept Character string 1.0.0 to 2.2.7
http.accept_encoding Accept Encoding Character string 1.0.0 to 2.2.7
http.accept_language Accept-Language Character string 1.0.0 to 2.2.7
http.authbasic Credentials Character string 1.0.0 to 2.2.7
http.authcitrix Citrix AG Auth Boolean 2.0.0 to 2.2.7
http.authcitrix.domain Citrix AG Domain Character string 2.0.0 to 2.2.7
http.authcitrix.password Citrix AG Password Character string 2.0.0 to 2.2.7
http.authcitrix.session Citrix AG Session ID Character string 2.0.0 to 2.2.7
http.authcitrix.user Citrix AG Username Character string 2.0.0 to 2.2.7
http.authorization Authorization Character string 1.0.0 to 2.2.7
http.cache_control Cache-Control Character string 1.0.0 to 2.2.7
http.chat Expert Info Label 1.12.0 to 2.2.7
http.chunk_boundary Chunk boundary Sequence of bytes 2.0.0 to 2.2.7
http.chunk_size Chunk size Unsigned integer, 4 bytes 2.0.0 to 2.2.7
http.chunkd_and_length Expert Info Label 1.12.0 to 2.0.13
http.chunked_trailer_part trailer-part Character string 1.12.4 to 2.2.7
http.connection Connection Character string 1.0.0 to 2.2.7
http.content_encoding Content-Encoding Character string 1.0.0 to 2.2.7
http.content_length Content length Unsigned integer, 8 bytes 1.0.0 to 2.2.7
http.content_length_header Content-Length Character string 1.0.5 to 2.2.7
http.content_type Content-Type Character string 1.0.0 to 2.2.7
http.cookie Cookie Character string 1.0.0 to 2.2.7
http.cookie_pair Cookie pair Character string 1.12.0 to 2.2.7
http.date Date Character string 1.0.0 to 2.2.7
http.file_data File Data Character string 2.2.0 to 2.2.7
http.host Host Character string 1.0.0 to 2.2.7
http.last_modified Last-Modified Character string 1.0.0 to 2.2.7
http.leading_crlf Expert Info Label 2.0.0 to 2.2.7
http.location Location Character string 1.0.0 to 2.2.7
http.next_request_in Next request in frame Frame number 1.10.0 to 2.2.7
http.next_response_in Next response in frame Frame number 1.10.0 to 2.2.7
http.notification Notification Boolean 1.0.0 to 2.2.7
http.prev_request_in Prev request in frame Frame number 1.10.0 to 2.2.7
http.prev_response_in Prev response in frame Frame number 1.10.0 to 2.2.7
http.proxy_authenticate Proxy-Authenticate Character string 1.0.0 to 2.2.7
http.proxy_authorization Proxy-Authorization Character string 1.0.0 to 2.2.7
http.proxy_connect_host Proxy-Connect-Hostname Character string 1.0.0 to 2.2.7
http.proxy_connect_port Proxy-Connect-Port Unsigned integer, 2 bytes 1.0.0 to 2.2.7
http.referer Referer Character string 1.0.0 to 2.2.7
http.request Request Boolean 1.0.0 to 2.2.7
http.request.full_uri Full request URI Character string 1.6.0 to 2.2.7
http.request.line Request line Character string 1.12.0 to 2.2.7
http.request.method Request Method Character string 1.0.0 to 2.2.7
http.request.uri Request URI Character string 1.0.0 to 2.2.7
http.request.uri.path Request URI Path Character string 2.2.0 to 2.2.7
http.request.uri.query Request URI Query Character string 2.2.0 to 2.2.7
http.request.uri.query.parameter Request URI Query Parameter Character string 2.2.0 to 2.2.7
http.request.version Request Version Character string 1.0.0 to 2.2.7
http.request_in Request in frame Frame number 1.10.0 to 2.2.7
http.request_number Request number Unsigned integer, 4 bytes 2.0.0 to 2.2.7
http.response Response Boolean 1.0.0 to 2.2.7
http.response.code Status Code Unsigned integer, 2 bytes 1.0.0 to 2.2.7
http.response.line Response line Character string 1.12.0 to 2.2.7
http.response.phrase Response Phrase Character string 1.6.0 to 2.2.7
http.response_in Response in frame Frame number 1.10.0 to 2.2.7
http.response_number Response number Unsigned integer, 4 bytes 2.0.0 to 2.2.7
http.sec_websocket_accept Sec-WebSocket-Accept Character string 1.8.0 to 2.2.7
http.sec_websocket_extensions Sec-WebSocket-Extensions Character string 1.8.0 to 2.2.7
http.sec_websocket_key Sec-WebSocket-Key Character string 1.8.0 to 2.2.7
http.sec_websocket_protocol Sec-WebSocket-Protocol Character string 1.8.0 to 2.2.7
http.sec_websocket_version Sec-WebSocket-Version Character string 1.8.0 to 2.2.7
http.server Server Character string 1.0.0 to 2.2.7
http.set_cookie Set-Cookie Character string 1.0.0 to 2.2.7
http.ssl_port Expert Info Label 2.0.0 to 2.2.7
http.subdissector_failed Expert Info Label 1.12.0 to 2.2.7
http.te_and_length Expert Info Label 2.2.0 to 2.2.7
http.te_unknown Expert Info Label 2.2.0 to 2.2.7
http.time Time since request Time offset 1.10.0 to 2.2.7
http.transfer_encoding Transfer-Encoding Character string 1.0.0 to 2.2.7
http.unknown_header Unknown header Character string 2.0.0 to 2.2.7
http.upgrade Upgrade Character string 1.8.0 to 2.2.7
http.user_agent User-Agent Character string 1.0.0 to 2.2.7
http.www_authenticate WWW-Authenticate Character string 1.0.0 to 2.2.7
http.x_forwarded_for X-Forwarded-For Character string 1.0.0 to 2.2.7
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
  • • Fully integrated with Wireshark and AirPcap™
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More

I need to capture wireless traffic...

ANSWER: AirPcap™ 802.11 Packet Capture
  • • WLAN packet capture and transmission
  • • Full 802.11 a/b/g/n support
  • • View management, control and data frames
  • • Multi-channel aggregation (with multiple adapters)
Learn More Buy Now