netmon

I know how to do it manually (by looking at the hex dump). How can I obtain the same automatically? Do I have to use the APIs? I have both wireshark and Microsoft network monitor. This can be achieved simply with a Lua dissector that adds an HTTP header field to the packet tree, allowing you to filter for it, as shown in this screenshot: Copy this Lua script into your plugins directory (e.g., ${WIRESHARK_HOME}/plugins/1.4.6/http_extra.lua ), and restart Wireshark (if already running). do local http_wrapper_proto = Proto("http_extra", "Extra analysis of the HTTP protocol"); http_wrapper_proto

I am trying to understand what's the actual difference between SSL and Kerberos authentications, and why sometimes I have both SSL traffic and Kerberos. Or does Kerberos use SSL in any way? Anyone could help? Thank you! While Kerberos and SSL are both protocols, Kerberos is an authentication protocol, but SSL is an encryption protocol. Kerberos uses UDP , SSL uses (most of the time) TCP . SSL authentication is usually done by checking the server's and the client's RSA or ECDSA keys embedded in something called X.509 certificates . You're authenticated by your certificate and the corresponding