Wireshark - Filter for Inbound HTTP Requests on Port 80 Only

Question

Using Highstock (StockChart type) I’ve created a timeline using flags with HTML and images. I’ve currently hard-coded the data but I’d like to add it via json. I’ve added the json file to the top of my code and created a variable for it (flagData). How can I add this using the json data to replace the hard-coded data?

https://jsfiddle.net/SkiWether/2cxgkmsv/

    var flagData = [{

        "productName": "Test Product A",
        "weekEndingData": [{
            "weekEnding": "11/16/2015",
            "testValue": 711,
            "flagBlocks": [{
                "blockName": "Box - 1",
                "imgUrl": "https://placeimg.com/75/50/nature"
            }]
        }, {
            "weekEnding": "11/23/2015",
            "testValue": 644,
            "flagBlocks": [{
                "blockName": "Box - 1",
                "imgUrl": "https://placeimg.com/75/50/animals"
            }]
        }, {
            "weekEnding": "11/30/2015",
            "testValue": 844,
            "flagBlocks": [{
                "blockName": "Box - 1",
                "imgUrl": "https://placeimg.com/75/50/nature"
            }, {
                "blockName": "Box - 2",
                "imgUrl": "https://placeimg.com/75/50/tech"
            }, {
                "blockName": "Box - 3",
                "imgUrl": "https://placeimg.com/75/50/animals"
            }]
        }, {
            "weekEnding": "12/07/2015",
            "testValue": 340,
            "flagBlocks": [{
                "blockName": "Box - 1",
                "imgUrl": "https://placeimg.com/75/50/tech"
            }, {
                "blockName": "Box - 2",
                "imgUrl": "https://placeimg.com/75/50/animals"
            }]
        }]
    }]

Solution

You need to differentiate between capture filters and display filters. The syntax you're showing there is a Wireshark display filter. Display filters are used to filter out traffic from display but aren't used to filter out traffic during capture. You can learn more about Wireshark display filters from the Wireshark wiki.

If you're going to be doing a long-term capture and you want to limit the size of your capture files you'll probably want to use a capture filter. Wireshark capture filters use tcpdump filter syntax, so an article about tcpdump filters will help you out.

To capture only HTTP traffic to/from the host 10.0.0.1, for example, you could use the capture filter host 10.0.0.1 and tcp and port 80. If you wanted that to include HTTPS traffic (TCP port 443) you could modify it to read host 10.0.0.1 and tcp and (port 80 or port 443).

For a display filter to do the same thing w/ HTTP only you'd be looking at ip.addr == 10.0.0.1 && tcp.port == 80. For both HTTP and HTTPS you'd be looking at ip.addr == 10.0.0.1 && (tcp.port == 80 || tcp.port == 443).

Comments

[SkiWether]

Thanks for the reply. Yes, I do understand it will need to be in a series format but I'm a relative newbie working with json and highstock/highcharts together. Do you possibly have any example code you could provide?

[Halvor Holsten Strand]

In short I think it comes down to parsing the JSON into a series-format.

[SkiWether]

Thank you! I updated your code to also include 'testValue'. The only thing I'm still having trouble with is getting the dates to function properly on the timeline. Any ideas? jsfiddle.net/xj2ndcm5

[SkiWether]

I was able to figure out the date issues with the timeline. It also fixed the Highcharts error I was receiving regarding the x-axis. Thank you for your help. I would not have been able to complete this without your code for looping through the data series. Here's my updated fiddle: jsfiddle.net/xj2ndcm5/1

[Paweł Fus]

With date, sorry it was my mistake. I assumed that first item in the date is day, while it is month. Swap week[1] with week[0].