Creating a Filter to Display HTTP Cookies

To create a filter to display HTTP cookies in Wireshark, take the following steps:

1. Open Wireshark and click on Analyze.
2. Select Display Filters.
3. Click on New.
4. For filter name, type HTTP cookie or whatever name you would like and for filter string type http.cookie.
5. Click on OK. You should then see only the packets containing HTTP cookies displayed.

Note: written for Wireshark 1.8.4, but should apply to other versions as well.

References:

1. cookie and query strings
   Wireshark Q&A

[/network/tools/sniffing/wireshark] permanent link

Installing Wireshark 1.8.4 and WinPcap 4.1.2 on a Windows 8 System

I installed Wireshark 1.8.4. When I started it, I was informed that I hadn't specified an interface on which to perform a capture. When I tried specifying an interface, I was informed there were no interfaces on which a capture could be done. I saw "(Unable to load WinPcap (wpcap.dll); you will not be able to capture packets."

I needed to install WinPcap in order to utilize Wireshark, so I downloaded WinPcap 4.1.2. When I ran the installation program, a Program Compatibility Assistant window opened stating "This program has compatibility issues." There were two options: (1) Get help online and (2) Run the program without getting help. I chose the latter. That resulted in a WinPcap 4.1.2 Setup window opening with the message "This version of Windows is not supported by WinPcap 4.1.2. The installation will be aborted."

To resolve the problem, the following steps can be taken.

1. Right-click on the installation file, WinPcap_4_1_2.exe and select Properties.
2. Click on the Compatibility tab.
3. Check the box next to "Run this program in compatibility mode for" and select "Windows 7".
4. Check the box for "Run this program as an administrator" under Privilege level.

   

5. Click on the OK button.
6. Run the installation program again and allow it to make changes to the system.
7. When the Program Compatibility Assistant window opens informing you that "This program has compatibility issues", select "Run the program without getting help". The WinPcap 4.1.2 Setup window should then open allowing you to proceed with the installation.

   

References:

1. [Winpcap-users] Windows 8
   By Andrew Stewart
   Date: July 6, 2012
   WinPcap
2. Installing WIRESHARK/WinPCap on Windows 8 RTM
   By Kaushal Kumar Panday
   Date: August 7, 2012
   Unleashed

[/network/tools/sniffing/wireshark] permanent link