Capturing HTTP traffic from a specific program / port - Page 1
Forum section: electronics / general

author: free_electron
author_rank: Super Contributor
timestamp: April 21, 2020, 01:27:01 pm
content: I've tried using wireshark , but i can't quite get it to where i want to be.Problem 1 :I want to monitor 1 specific program talking to 1 specific port to one specific address.For some reason i keep seeing other traffic to the same machine ( other ports ) ,error packets, handshake packets, ping packets etc ...I am only interested in the one port.i set up a capture filter: HOST 192.168.1.14 AND PORT 9780i still see SMB2 , TCP , ICMP , DNS , ARP and other stuff. what am i doing wrong ? i am only interested in HTTP traffic.Problem 2 : if a message is longer than an ethernet frame it is spread across multiple 'messages'. i'd like to see the entire message as 1 view. now it gives me a ton of 'continuation' packets.it would be nice to see something likeoutgoing 1- packet 1- packet 2incoming 1- packet 1- packet 2- ......- packet 329outgoing 2So it is easier to find when new messages start.I am trying to trace the communication (SOAP / XML over HTTP) between client and host to find out the command set.Right now there is too much 'noise' in the trace.

author: eliocor
author_rank: Unknown
timestamp: April 21, 2020, 04:48:21 pm
content: maybe (using Wireshark filter):Code:tcp.port==9780 and ip.addr==192.168.1.14should filter correctly your packets.

author: MarkL
author_rank: Unknown
timestamp: April 21, 2020, 05:06:31 pm
content: On problem 1: What "set up" did you do for the capture filter? If you only defined it, it also needs to be enabled on your Ethernet interface.On my version of Wireshark, it doesn't like upper case for capture filters, but it does print out an error. Just a thought.On problem 2: You could try "Analyze-->Follow TCP Stream" to put the input and output bytes back together for a specific stream.You may also find some of the choices under "Statistics" to be useful, such as "Conversations".

author: free_electron
author_rank: Super Contributor
timestamp: April 21, 2020, 05:41:02 pm
content: Quote from: MarkL on April 21, 2020, 05:06:31 pmIt is enabled for the interface.I only see traffic to and from port 9780 but there are various kinds of traffic.I m only interested in http traffic.Quotecorrect i use lowercase.QuoteThat works but the problem is finding where one stream stops and another begins.There are hundreds of lines for one 'message' so i would like to see the packets 'grouped'Now it is just a list of packets.you have to scroll to find out when the next 'message begins'.This thing is conversation between a front-end and a database backend. The messages can be enormous.wireshark properly follows the conversation but only for one outgoing , and the answer. The problem is finding an easy way to scroll to the next 'conversation'You may also find some of the choices under "Statistics" to be useful, such as "Conversations".

author: gmb42
author_rank: Frequent Contributor
timestamp: April 22, 2020, 06:00:12 pm
content: Quote from: free_electron on April 21, 2020, 01:27:01 pmApart from the casing as noted elsewhere, that's a valid capture filter, just a thought is the IP address shown the target machine and not the local machine? The port clause should still be limiting the capture though.Note that the specified filter, indeed the BPF engine used for capture filtering, says nothing about HTTP, only that the traffic must have an IPv4 header and in that header the source or destination address must have that IP and that the traffic must have a TCP\UDP header and in that header the source or destination port must have that port number.Can you share a capture file?Quote from: free_electron on April 21, 2020, 01:27:01 pmWireshark's UI is very much frame orientated, so when you have application protocols that send bigger messages that span multiple transport segments, you will see the individual segments (e.g. HTTP continuations). You can clear out the noise by applying a display filter to limit it to only your highest level supported protocol, i.e. "http" in this case.You can also use the File -> Export Objects -> HTTP ... option to export each SOAP\XML request or response to a separate file.

author: Tony_G
author_rank: Super Contributor
timestamp: April 22, 2020, 06:35:56 pm
content: Have you loooked at Fiddler?https://www.telerik.com/fiddlerWe used this extensively at MS for doing exactly this.TonyG

author: 1xrtt
author_rank: Regular Contributor
timestamp: April 22, 2020, 07:45:39 pm
content: Quote from: eliocor on April 21, 2020, 04:48:21 pmI´m using Wireshark version 3.0.x here and it does not accept capture filters with ALL CAPS. Try using "host 192.168.1.14 and port 9780"However, the display filter above should work as is. I usually don´t use capture filters, as sometimes I may want to look into other traffic that give clues to a problem (like ICMP unreachable packets, for example), so I would suggest to clear all capture filters and try using display filters, first.If the traffic volume is too high, then you may use a capture filter to reduce it.Sometimes I use fiddler, but for traffic analysis at packet level, nothing really beats Wireshark.

author: free_electron
author_rank: Super Contributor
timestamp: April 23, 2020, 01:16:22 pm
content: Quote from: Tony_G on April 22, 2020, 06:35:56 pmThat won't work. This system runs on a closed network (no internet access) so most likely it can't route the packets from my machine , over the internet, to telerik's machines to 'sniff' , back into my network to throw it on the VPN to the server ...Even if it would succeed in finding a way .. i don't want the data to sniffed externally. Wireshark stays on my side of the fence...Same reason i won't share traces from wireshark ...If you must know what i am trying to do : sniff the traffic between Altium Designer and the Altium Vault server to learn the command syntax for certain operations so i can drive those from a script.Like :- elevate the release status for object x from 'new' to 'prototype'- for latest_release of (object 'x') , set the value of parameter 'z' to 'something'you can do all those things through the UI , but not through their exposed API. However, since the Ui can do it there must be a SOAP command to execute it. All traffic between the client and the server is going through SOAP / XML. Only the footprints and symbols are binary blobs , but i am not manipulating those.I want to find a way to bulk upload 'textual' data into the tables so i can shoot pricing information , stock levels, compliance flags etc from a script.Now i have to do this using copy-paste operations and i can spend days updating hundreds of parts ... if i can script this it would take seconds. i can make a command file the script would execute.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: April 23, 2020, 08:52:37 pm
content: Quote from: free_electron on April 23, 2020, 01:16:22 pmFiddler doesn't work like that. When they say "proxy server", what they mean is that the Fiddler software (that you install locally) acts as an HTTP proxy server that in addition to forwarding the traffic, captures and allows you to 'fiddle' with the data (e.g. modify and replay a request). Works with HTTPS traffic too if you're able to install a 'fake' secure root certificate so that Fiddler can impersonate the remote server.If you're able to make Altium route all HTTP traffic through a user-defined proxy server, then Fiddler is an option.

author: free_electron
author_rank: Super Contributor
timestamp: April 24, 2020, 11:40:16 pm
content: Quote from: HwAoRrDk on April 23, 2020, 08:52:37 pmok then. i thought this was one of those 'web' services. there are a number of service providers out there that do analytics and packet inspection. but it involves routing the traffic over their machines

author: cdev
author_rank: Super Contributor
timestamp: May 05, 2020, 03:55:31 pm
content: There are a number of web app debugging tools that you run locally which act as a proxy and can allow you to debug HTTPS traffic. As stated elsewhere you need it to use the appropriate certificates.Its a PITA but it gives you back the sniffing abilities taken by the switch to https. If I were you I would turn off web sockets while you do this.