Hello all.
This is my first post and thank you for your forum.
Here is my question.
I have a simple setup at home and I was capturing some data with wireshark.
Data between a workstation and the web server, requesting a page.
Simple enough.
Now when I open wireshark, I apply the TCP only filter for both capture live data and for display data but on the display window I am also getting HTTP along with TCP.
I just need to view TCP, so I can understand sequencing, headers and so forth.
HTTP is at the application layer, why am I seeing it here? I am confused.
Help?
HTTP uses TCP for reliable transfer, flow control, etc. HTTP data is encapsulated in a TCP header (which is then encapsulated in an IP header, then an Ethernet/whatever header, on its way down the stack). Whenever you see HTTP, you should expect to see TCP.
To see this in Wireshark, select a packet marked as HTTP, then look in the middle frame of Wireshark, where the dissected packet is shown (it would be right below the picture you posted). Look through that, and you'll see both the TCP header and HTTP data. Click the plus sign next to the TCP header if that's what you want to see.
TCP is a generic protocol, quite a lot of things use it. Wireshark tells them apart by what port they use -- it assumes TCP traffic on port 80 is HTTP.
if you want to learn tcp, you might want to filter the trace with a single source and destination address and a single port number to see just one TCP session.
yes, as what others responded on your post wireshark has lots of options for you to choose from when searching. In your case, I suggest to search for a single source or destination address as well or port specific.