Guides / HTTP conversations

Extracting HTTP conversations from PCAPNG

Identify clear-text HTTP traffic, export request metadata and reconstruct individual TCP streams—without mistaking encrypted HTTPS for missing data.

By Stuart Mathieson7 minute readWireshark + tsharkUpdated 25 September 2026

First determine whether the traffic is readable

HTTP on port 80 or another clear-text port can expose methods, hosts, paths, headers and bodies. HTTPS encrypts those application bytes. Without suitable session keys and the matching handshake, a capture normally reveals connection metadata and often TLS SNI, but not HTTP paths or content.

Start with these display filters:

http
http.request
http.response
tls.handshake.extensions_server_name

If traffic uses an unusual clear-text port, right-click a packet and choose Decode As... to map that TCP port to HTTP.

Export one row per request

tshark -r capture.pcapng -Y "http.request" \
  -T fields -E header=y -E separator=, -E quote=d \
  -e frame.number -e frame.time_epoch -e tcp.stream \
  -e ip.src -e ip.dst -e http.request.method \
  -e http.host -e http.request.uri -e http.user_agent

The tcp.stream value is the bridge from a summary row to the complete conversation. To inspect stream 12 in Wireshark, filter tcp.stream eq 12, then choose Follow → TCP Stream.

Match requests and responses

HTTP/1.1 may reuse a TCP connection for many requests. Do not assume one stream equals one request. Wireshark exposes request/response relationship fields; a practical investigation is:

Filter http.request and identify the host, method and URI.
Note the request frame and stream number.
Filter to the stream and locate the corresponding response.
Check status, content type, content length and time from request to response.
Use File → Export Objects → HTTP only when policy permits exporting captured content.

Captured HTTP may contain secrets.

URLs, cookies, authorization headers and form bodies can hold credentials or personal data. Store extracts with the same—or stronger—controls as the original capture, and do not paste sensitive payloads into third-party analysis services.

Know the decoding limits

A capture that starts mid-connection may not contain enough state for clean reassembly.
Missing TCP segments can make headers or bodies incomplete.
HTTP/2 uses binary framing and usually runs inside TLS; HTTP/3 runs over QUIC.
Proxies can make the observed peer different from the ultimate application host.
Compression and chunked transfer encoding affect what a raw stream looks like.

Manual method vs PCAPNG Analyzer

Manual method

Filter for HTTP requests and responses.
Export request fields with tshark.
Group by tcp.stream.
Follow selected streams and inspect timing.
Export objects only when authorised.

With PCAPNG Analyzer

Upload or auto-ingest the PCAPNG.
Review HTTP hosts, methods and network conversations.
Open HTTP analysis for paths, user agents, status codes and content types.
Filter packets by endpoint, port or payload text and inspect decoded HTTP fields.

What remains encrypted

PCAPNG Analyzer decodes clear-text HTTP found in captured TCP payloads. It reports TLS handshake metadata such as SNI and certificates separately, but it does not turn ordinary encrypted HTTPS into readable HTTP content.

Turn clear-text HTTP traffic into a readable report

Inspect hosts, methods, paths, user agents and responses while the capture stays on your server.

Compare tiers Self-host it