Guides / HTTP conversations

Extracting HTTP conversations from PCAPNG

Identify clear-text HTTP traffic, export request metadata and reconstruct individual TCP streams—without mistaking encrypted HTTPS for missing data.

By Stuart Mathieson7 minute readWireshark + tsharkUpdated 12 October 2026

The quick way

Upload the capture and PCAPNG Analyzer lays out the clear-text HTTP for you: hosts, methods, status codes, the most requested and suspicious paths, and user agents, with server response times under Network health. Any conversation opens as a readable stream, and in Pro every file sent or received is listed with its SHA-256 hash and a download.

See a sample report →

First determine whether the traffic is readable

HTTP on port 80 or another clear-text port can expose methods, hosts, paths, headers and bodies. HTTPS encrypts those application bytes. Without suitable session keys and the matching handshake, a capture normally reveals connection metadata and often TLS SNI, but not HTTP paths or content.

Start with these display filters:

http
http.request
http.response
tls.handshake.extensions_server_name

If traffic uses an unusual clear-text port, right-click a packet and choose Decode As... to map that TCP port to HTTP.

Export one row per request

tshark -r capture.pcapng -Y "http.request" \
  -T fields -E header=y -E separator=, -E quote=d \
  -e frame.number -e frame.time_epoch -e tcp.stream \
  -e ip.src -e ip.dst -e http.request.method \
  -e http.host -e http.request.uri -e http.user_agent

The tcp.stream value is the bridge from a summary row to the complete conversation. To inspect stream 12 in Wireshark, filter tcp.stream eq 12, then choose Follow → TCP Stream.

Match requests and responses

HTTP/1.1 may reuse a TCP connection for many requests. Do not assume one stream equals one request. Wireshark exposes request/response relationship fields; a practical investigation is:

Filter http.request and identify the host, method and URI.
Note the request frame and stream number.
Filter to the stream and locate the corresponding response.
Check status, content type, content length and time from request to response.
Use File → Export Objects → HTTP only when policy permits exporting captured content.

Captured HTTP may contain secrets.

URLs, cookies, authorization headers and form bodies can hold credentials or personal data. Store extracts with the same—or stronger—controls as the original capture, and do not paste sensitive payloads into third-party analysis services.

Know the decoding limits

A capture that starts mid-connection may not contain enough state for clean reassembly.
Missing TCP segments can make headers or bodies incomplete.
HTTP/2 uses binary framing and usually runs inside TLS; HTTP/3 runs over QUIC.
Proxies can make the observed peer different from the ultimate application host.
Compression and chunked transfer encoding affect what a raw stream looks like.

Manual method vs PCAPNG Analyzer

Manual method

Filter for HTTP requests and responses.
Export request fields with tshark.
Group by tcp.stream.
Follow selected streams and inspect timing.
Export objects only when authorised.

With PCAPNG Analyzer

Upload the capture.
Choose See HTTP analysis for status codes, paths and user agents, and follow any conversation as a stream.
In Pro, choose See files to download request and response bodies, each with its type and SHA-256 hash.

What it reads

Everything sent over plain HTTP, request and response bodies included. For HTTPS it reports what the handshake reveals (server names, certificates where visible, client fingerprints), but, like any tool without the session keys, it can’t turn encrypted traffic into readable HTTP.

Turn clear-text HTTP traffic into a readable report

Inspect hosts, methods, paths, user agents and responses while the capture stays on your server.

Compare tiers Download free