The latest articles on DEV Community by Gordon Deng (@gordon_deng). https://dev.to/gordon_deng https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4190542%2Fbf87a21e-9316-4d4d-867a-c965f7c68d42.jpg https://dev.to/gordon_deng en Gordon Deng Sun, 18 Oct 2026 08:31:04 +0000 https://dev.to/gordon_deng/wireshark-shows-dns-for-an-http-lab-site-but-no-plaintext-http-get-on-wlan-hm4 https://dev.to/gordon_deng/wireshark-shows-dns-for-an-http-lab-site-but-no-plaintext-http-get-on-wlan-hm4 <p>I'm doing a university Wireshark lab and I’m stuck on a packet-capture issue. I’d appreciate help understanding what is happening and what I should capture next.</p> <h2> Goal </h2> <p>Capture a plaintext HTTP request/response for this lab URL in Wireshark:</p> <p><em><a href="http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html" rel="noopener noreferrer">http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html</a></em></p> <p>The page is expected to return a simple welcome message, and the lab requires analyzing the HTTP GET and the server response.</p> <h2> Environment </h2> <ul> <li>Windows</li> <li>Wireshark 4.6.9</li> <li>Microsoft Edge</li> <li>Capturing on the <strong>WLAN</strong> interface</li> </ul> <h2> What I observe </h2> <p>In the first capture:</p> <ul> <li>DNS resolution for <code>gaia.cs.umass.edu</code> is visible.</li> <li>The lab server resolves to <code>128.119.245.12</code>.</li> <li>My client’s private IPv4 address is <code>172.27.x.x</code>.</li> <li>Applying the display filter <code>http</code> does <strong>not</strong> show the expected GET request to <code>gaia.cs.umass.edu</code>.</li> <li>The HTTP-filtered packets appear to be unrelated Windows connectivity-check traffic.</li> <li>There is a connection from the client to the lab server on TCP port 443 (HTTPS), but the lab needs the plaintext HTTP request on port 80.</li> </ul> <p>The confusing part is that the site itself works over HTTP. I tested it separately with <code>curl</code> and got <code>200 OK</code> with no redirect, and the expected welcome text:</p> <blockquote> <p>Congratulations! You've downloaded the first Wireshark lab file!</p> </blockquote> <p>So the server supports plaintext HTTP. The problem seems to be on the capture/routing side.</p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frpdpwuw7wontveqa0nkd.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frpdpwuw7wontveqa0nkd.png" alt=" " width="452" height="227"></a></p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F69ae5enks5visn75k4p4.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F69ae5enks5visn75k4p4.png" alt=" " width="799" height="666"></a></p> <h2> What I’ve tried </h2> <ul> <li>Confirmed the URL starts with <code>http://</code>, not <code>https://</code>.</li> <li>Checked that Edge’s “always use secure connections / automatic HTTPS” option is not enabled.</li> <li>Captured on WLAN and filtered with: <ul> <li><code>http</code></li> <li><code>http.host == "gaia.cs.umass.edu" || http.response</code></li> <li><code>dns.qry.name == "gaia.cs.umass.edu"</code></li> </ul> </li> <li>DNS packets are captured, but the expected HTTP GET is not.</li> <li>I have fully exited the accelerator/proxy software and repeated the capture in a clean InPrivate window.</li> </ul> <p>Any debugging suggestions would be very helpful. I can share sanitized packet details or a filter output if needed, but I’d rather not upload the full capture because it may contain unrelated traffic.</p> wireshark networking http help