previous (09): Examine the HTTP requests (...)

[10] As you can see, the first HTTP request is perfectly ordinary, but the other two are most unusual: there is no browser information, the weird OPTIONS * method is used, and the client requests the URL /antidisestablishmentarianism which our server doesn't host.

Examine all HTTP requests that contain no browser information. To do this, enter a filter condition in the Filter field to mean: show all HTTP request packets without a user-agent value. To see a list of valid keywords for filter expressions, click the + Expression button to edit filter parameters:

Now open the HTTP category in the Field name list.

Browse through the available parameters and make a note of the ones that might be useful. Now enter the following in the Filter field:

http.request && !(http.user_agent)

Press [Enter]. Examine the filtered packets. Can you see what they may indicate?

(+) show hint

next (11): Now let's try to automate the analysis process (...)

contents