Wireshark-dev: Re: [Wireshark-dev] Lots of Header Packets, but No Data Packets?
From: "Maynard, Chris" <[email protected]>
Date: Thu, 10 Apr 2008 17:15:12 -0400
Perhaps you have more than one interface?  If you're running on Linux,
try capturing on the "any" interface.  If you're running on Windows or
some other OS that doesn't allow you to capture on all interfaces at the
same time, try running 2 instances of Wireshark, one on each interface,
then merge the captures together into one file with mergecap.  There
might be an easier way.  Or this might not be relevant at all. :)

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of
[email protected]
Sent: Wednesday, April 09, 2008 12:53 PM
To: [email protected]
Subject: [Wireshark-dev] Lots of Header Packets, but No Data Packets?

I've spent a few hours now trying various Wireshark options, Googling,
etc. - but I just can't seem to get WireShark to show me any DATA

I see lots of header packets associated with my http: request and
just no Data packets.

I'm simply displaying various small .htm web pages using http://.

I'm logged into the server (through Terminal Server) as Administrator.

I can see Data packets in the sample capture files listed on your
just not in any of the captures I do using my server's own traffic.

I've tried it with and without capture filters.

I have no display filters enabled.

...I just can't seem to get there.

I know data is being sent because I can see it in the web page on my

Attached is a PDF showing my capture.

If you can give me some ideas to pursue to further diagnose I would be


Craig Barton
[email protected]