However, if you know the TCP port used (see above), you can filter on that one. You cannot directly filter HTTP2 protocols while capturing. What you can also do is type eq instead of, since eq refers to equal. For example, if you want to filter port 80, type this into the filter bar: tcp. Show only the HTTP2 based traffic: http2 Capture Filter How do I filter Wireshark by port Filtering by port in Wireshark is easy thanks to the filter bar that allows you to apply a display filter. For filtering only DNS responses we have 1. For filtering only DNS queries we have 0. The common display filters are given as follows: The basic filter is simply for filtering DNS traffic. Display FilterĪ complete list of HTTP2 display filter fields can be found in the display filter reference There are some common filters that will assist you in troubleshooting DNS problems. On the SampleCaptures page, there is also http2-16-ssl.pcapng containing a HTTP2 (draft 16) over SSL capture (with keys) and a link to a TLS 1.3 HTTP/2 capture. Sample of HTTP2 (draft-14) - Created with nghttp2, need to use Decode as HTTP2 Http2-h2c.pcap - HTTP/2 via Upgrade: h2 mechanism ( curl -http2 -v /robots.txt /humans.txt)

Wireshark 2.4 - header decompression support now requires external nghttp2 package (true for official Windows/macOS builds).

Wireshark 2.0 - initial HPACK support (header decompression).The well known TCP port for HTTP/2 traffic is 443 (and 80).

TCP: Typically, HTTP/2 uses TCP as its transport protocol.

Hypertext Transfer Protocol version 2 (HTTP2) Protocol dependencies

Filter https wireshark