Introduction to the OSI Model

Hello Jim

What you describe is normal behavior. Remember, communication between a web server and a client takes many forms, and has different characteristics, so the different filters you use will have different results.

The tcp.dstport==80 filter will only show packets with a destination port of 80. By definition, such packets are those sent from the client to the server. Any responses from the server will not have a destination port of 80 but a source port of 80.

If you simply enter http as the filter, then it will include HTTP traffic in both directions.

For the filter, you must keep in mind that this is a filter used to filter out packets based on the Host header field in HTTP requests. Take a look at one of the HTTP request packets in your capture and examine what is found within the HTTP header to see why the filter isn’t working.

I hope this has been helpful!


1 Like