The 'Filter Expression' dialog box can help you build display filters. So to sniff particularly POST data, you need to use filter inside Wireshark Filter Section bar. Here, Wireshark is listening to all network traffic and capturing them.

For display filters, try the display filters page on the Wireshark wiki. In case of Linux, you can start the Wireshark by typing sudo wireshark command in your terminal and select the interface and start the capturing process. For example, to capture only packets sent to port 80, use: dst tcp port 80Ĭouple that with an http display filter, or use: tcp.dstport = 80 & httpįor more on capture filters, read ' Filtering while capturing' from the Wireshark user guide, the capture filters page on the Wireshark wiki, or pcap-filter (7) man page. If you want to measure the number of connections rather than the amount of data, you can limit the capture or display filters to one side of the communication. logResponse(wrapper) response.getOutputStream().write(wrapper.getCopy().getBytes()) What I am not able to understand is, how to put back the request body in the input stream after reading it. Note that a filter of http is not equivalent to the other two, which will include handshake and termination packets. After logging the response I am writing the response back to the output stream so that the client can receive the response. Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of: icmpĪnd a display filter of: icmp.type = 8 || icmp.type = 0įor HTTP, you can use a capture filter of: tcp port 80

Wireshark filter http response body