I'm doing a university Wireshark lab and I’m stuck on a packet-capture issue. I’d appreciate help understanding what is happening and what I should capture next.
Goal
Capture a plaintext HTTP request/response for this lab URL in Wireshark:
http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html
The page is expected to return a simple welcome message, and the lab requires analyzing the HTTP GET and the server response.
Environment
- Windows
- Wireshark 4.6.9
- Microsoft Edge
- Capturing on the WLAN interface
What I observe
In the first capture:
- DNS resolution for
gaia.cs.umass.eduis visible. - The lab server resolves to
128.119.245.12. - My client’s private IPv4 address is
172.27.x.x. - Applying the display filter
httpdoes not show the expected GET request togaia.cs.umass.edu. - The HTTP-filtered packets appear to be unrelated Windows connectivity-check traffic.
- There is a connection from the client to the lab server on TCP port 443 (HTTPS), but the lab needs the plaintext HTTP request on port 80.
The confusing part is that the site itself works over HTTP. I tested it separately with curl and got 200 OK with no redirect, and the expected welcome text:
Congratulations! You've downloaded the first Wireshark lab file!
So the server supports plaintext HTTP. The problem seems to be on the capture/routing side.
What I’ve tried
- Confirmed the URL starts with
http://, nothttps://. - Checked that Edge’s “always use secure connections / automatic HTTPS” option is not enabled.
- Captured on WLAN and filtered with:
httphttp.host == "gaia.cs.umass.edu" || http.responsedns.qry.name == "gaia.cs.umass.edu"
- DNS packets are captured, but the expected HTTP GET is not.
- I have fully exited the accelerator/proxy software and repeated the capture in a clean InPrivate window.
Any debugging suggestions would be very helpful. I can share sanitized packet details or a filter output if needed, but I’d rather not upload the full capture because it may contain unrelated traffic.
