HTTPS appears to be an new overhead problem with AT&T customers with recent Fiber Broadband network changes. HTTP packets travel this same route but the unsecured, unencrypted packets are not causing a slow down. Of recent, this DPI, Monitoring activity has been impacting our HTTPS channel communications. Select an interface by clicking on it, enter the filter text, then click on the Start button.

You will see a list of available interfaces and the capture filter field towards the bottom of the screen. Why could the reasons for this to happen with only HTTPS and not HTTP?ĪT&T is performing packet security analysis and DPI (Deep Packet Inspection) in their main network/data center. If you don’t see the Home page: Click on Capture on the menu bar and then select Options from that drop-down menu. With escalated support, AT&T has asked that I get a WireShark capture to illustrate the problem. However, all other hosted domains on HTTPS are being disrupted and degraded. While there are still some delays, the packets do not timeout and reset. Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library. It appears AT&T has taken the two main domains I cited as examples showing the problem, and and 'white listed' them to improve the HTTPS performance. An overview of the capture filter syntax can be found in the Users Guide.A complete reference can be found in the expression section of the pcap-filter(7) manual page. In the past month, AT&T has begun degrading, intentionally or unintentionally, the HTTPS channel causing packet disruptions, timeouts and resets with the browser. I need to do this for three sites on my network. Start Capturing and Log from SRC IP the HTTPS connection to host IP XYZ. What would the command be to capture filter or script or menu options or a reference to an online example? I need to basically say:

I need to capture the traffic from my Win7 machine where I just installed WireShark v3 to HTTPS web sites hosted at small office network with AT&T Fiber Ethernet. Use this display filter to find the DNS queries and answers for the domain.

Wireshark filter by domain name