Steve, Wireshark is unable to reassemble these packets it seems. If you disable "Allow subdissector to reassemble TCP streams" in the tcp protocol preferences, the HTTP-401 is indeed shown. This allows you to filter on http or http.response.code==401 as a workaround.
Could you file this as a bug on http://bugzilla.wireshark.org, mentioning that http-reassembly does not work correctly in this case and attach the tracefile to the bug? Thanks, Cheers, Sake ----- Original Message ----- From: Steve Crowl To: Community support list for Wireshark Sent: Monday, September 24, 2007 8:33 PM Subject: Re: [Wireshark-users] HTTP Filter for 401 response Hi Sake. Yes, I can see HTTP/1.1 200 OK messages for example. The attached capture file contains the 401. All boxes are checked for HTTP preferences with Alternate TCP port = 0; all boxes checked for TCP except Try heuristic sub-dissector first. Thanks, Steve Sake Blok wrote: Hi Steve, Does it show other http responses as HTTP? If so, could you send in a little capture file (just the tcp stream containing the 401) that shows this behaviour? If not, what are your settings in the tcp and http protocol preferences? Cheers, Sake ----- Original Message ----- From: <[EMAIL PROTECTED]> To: <wireshark-users@wireshark.org> Sent: Monday, September 24, 2007 5:57 PM Subject: [Wireshark-users] HTTP Filter for 401 response I have version 0.99.6a installed on WinXpSP2. The default installation of wireshark does not display the HTTP 401 Authorization Required using the HTTP filter; it is labeled TCP. Do I need to change a preference or some other setting so that HTTP filter includes the 401? Thanks, Steve _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users ------------------------------------------------------------------------------ _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
_______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
