determining full url from wireshark

i am watching a video stream from a proprietary app and i want to know the URL it's connecting to. note that in this case, i know the URL that it connects to but am curious how i'd determine it us开发者_Go百科ing wireshark.

i have wireshark open and i let it scan for a few seconds. i looked at the results, and all i was able to determine was the url and port of the site that's providing the stream. there's a series of URL parameters that are important as well. is there a way with wireshark to see the whole url that the app is connecting to?

A full URL is the concatenation of 'host' and 'path' ('path' is URI in wireshark's jargon). The concatenation of these strings usually does not pass on wire - you will not see it in wireshark - and it is not required by HTTP.

Therefore, you have to concatenate them on you own, either manually or using some software as the one proposed by the writer of the lua dissector.

Example:

GET /path HTTP/1.1
Host: www.amazon.com

thus, the full URL is: www.amazon.com/path

There is no such thing as a "whole" url. An application may connect to many servers during it's lifetime.
There could be different servers for authentication, configuration, logging, data, etc.
Wireshark is a low-level monitoring tool. You can choose to watch the packets of a specific osi-layer and add filters to limit the output. But I don't think it can aggregate all the incoming connections of a specific application.

Please, check out following custom dissector written in Lua, that helps showing full URL in wireshark HTTP captures

Feel free to ask any questions regarding it, upvoting is preferred as well ;)