Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?

share|improve this question
add comment

2 Answers

up vote 12 down vote accepted

As 3molo says. If you're intercepting the traffic, then port 443 is the filter you need. If you have the site's private key, you can also decrypt that SSL . (needs an SSL-enabled version/build of Wireshark.)

See http://wiki.wireshark.org/SSL

share|improve this answer
1  
There is a difference between filtering and monitoring. WireShark is a monitoring tool. Filtering would have to be done with a firewall or similar. –  txwikinger Apr 26 '11 at 15:13
1  
@TXwik You filter what you're monitoring with WireShark.... –  Holocryptic Apr 26 '11 at 15:58
1  
Question could be clearer ;) –  txwikinger Apr 27 '11 at 20:58
add comment

"port 443" in capture filters. See http://wiki.wireshark.org/CaptureFilters


It will be encrypted data though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.