HTTP display filters

Some common HTTP display filters are as follows:

• Display all HTTP packets going to hostname:
  • http.request.method == <"Request methods">
• Packets with HTTP GET methods:
  • http.request.method == "GET"
• Display URI requested by client:
  • http.request.method == <"Full request URI">
  • http.request.uri == "/v2/rating/mail.google.com"
• Display URI requested by client that contains a specific string (all requests to Google in this example):
  • http.request.uri contains "URI String"
  •  http.request.uri contains "mail.google.com"
• All cookie requests sent over the network (note that cookies are always sent from the client to the server):
  • http.cookie
• All cookie set commands sent from the server to the client:
  • http.set_cookie
• All cookies sent by Google servers to your PC:
  • (http.set_cookie) && (http contains "google")
• All HTTP packets that contain a ZIP file:
  • http matches ".zip" && http.request.method == "GET"