Show any field in the packet list display

This can be done with any field but this example shows the full URL for HTTP requests.

In the display filter type http.request to show requests for web pages.

Scroll down the packet info window and make sure Hypertext Transfer Protocol is expanded. Then right click on the text that says Full request URI: and choose Apply as Column. Packets containing web requests should now have the full URL visible in the packet

Useful fields to display

Depends what protocol you're interested in obviously, but I find these handy

field

fieldname

Country*

ip.geoip.country

HTTP URL

http.request.full_uri

JA3 signature**

ja3.hash

TLS server identifier*

tls.handshake.extensions_server_name

* needs a geoIP db

** needs a plugin

*** if you haven't updated Wireshark recently it will be ssl.handshake... but that's deprecated and you should update.

Last updated

Was this helpful?