Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] HTTP filter

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Mon, 3 Jan 2011 12:08:10 -0700
On Mon, Jan 03, 2011 at 05:17:21PM +0900, Andrej van der Zee wrote:

> I was wondering how wireshark implements the HTTP filter. Does it just 
> look at the destination port only?

The display filter "http" displays all packets handled by the HTTP 
dissector.  The HTTP dissector will work on packets meeting one of these 
criteria:

 - One of the ports from the "TCP Ports" HTTP preference

 - One of the ports from the "SSL/TLS Ports" HTTP preference

 - Another dissector that uses HTTP on a different port such as IPP