Re: filter for ONLY initial get request

["Thierry Emmanuel" <Emmanuel.Thierry () technicolor com>]

-----Original Message-----
From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Sake Blok
Sent: jeudi 12 août 2010 11:08
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] filter for ONLY initial get request


> The best I have come up with so far is to look only at requested objects of type "text/html" and then look at the 
> referer instead of the host header (and the host header if the referer is empy). But also this is far from perfect. 
> It leaves in false positives and might have some false negatives too. But you can give it a shot to see how it 
> compares to what you already have...

I don't know how you want to use the referrer header. It is filled whether the object were requested by the browser to 
complete the display of the page or by the user by clicking on a link. The only case it isn't given by the browser is 
when the user explicitly type an url in the address bar of his favorite browser.

Best regards

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe