How to see webpage content (as a whole) sent to user with wireshark

Question

I use my pc as the wifi hotspot, and connect other devices to it. Then with wireshark, I can see the packets sending/receiving on a specific device, but how can I see the complete webpage that the device is viewing instead of separate packets?

score 3 · Answer 1 · answered Aug 23 '13 at 07:35

3

Try to find packets of HTTP protocol with data. Try filter: http && (media || data-text-lines). And look what you get in this packets. enter image description here

answered Aug 23 '13 at 07:35

graphite

2,920
22
40

thank you. very helpful. Could you further explain how I can transform these codes into a web page? since there are many 'noise' that aren't html i.e. t\r\n [truncated] etc.. – Arch1tect Aug 24 '13 at 06:13
Exactly, right-click on 'Line-based text...' line -> 'Export Selected Packet Bytes...' Then you can open it in your browser. – graphite Aug 26 '13 at 07:47

score 0 · Answer 2 · answered Aug 22 '13 at 08:56

0

You can not see the web page you can just see the protocol packets.

for detailed information please refer http://www.wireshark.org/faq.html section 7

answered Aug 22 '13 at 08:56

CodingRat

1,934
3
23
43

I saw it somewhere that you can sort of reassembly the packet to form the web page or image... – Arch1tect Aug 22 '13 at 09:09

score 0 · Answer 3 · edited May 23 '17 at 12:05

As @graphite said, you can save the line to a file. Your packet capture should also have caught the supporting files such as .css, images, etc; you may need to make placeholder files if you didn't get these.

You may also look at this answer here; the options included seem to more or less address what you're looking for: Complete reconstruction of TCP Session (HTML pages) from WireShark pcaps, any tools for this?

I'm kind of surprised I couldn't find some sort of "replay" browser plugin that takes PCAPs and simulates it using IE's DLL or the like...

How to see webpage content (as a whole) sent to user with wireshark

3 Answers3