Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] filter for ONLY initial get request

From: "Thierry Emmanuel" <Emmanuel.Thierry@xxxxxxxxxxxxxxx>
Date: Thu, 12 Aug 2010 14:09:42 +0200

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Sake Blok
Sent: jeudi 12 août 2010 12:06
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] filter for ONLY initial get request

> The thought behind using the referer header is that it will filter out the objects that the user did not manually requested. Give it some thought, a user types in a URL in the browser, the referer is empty so we need to count this request. The page contains several objects. They are requested with the requested page as the referer. It is save to count these as this is what the user requested. Even though the requested objects are for advertisements (which the OP wants to skip). As long as the user clicks on links that link to pages on the same site, we are fine.
>
> Then the user clicks on a link to another site. OK the referer still points to the original site (so we have a miscount of 1), but assuming the user clicks on at least one link on within the new site, the new site still gets listed, only with one less count.
>
> Next to that I followed your handy tip to not count every object, but only count objects of type html by filtering on the Accept: header.

Oh, ok.
Sounds interesting, I didn't thought about a solution so complex ! I just have a little doubt about the benefits compared to the complexity of the implementation of such a process !

Best regards