Hypertext Transfer Protocol version 2 (HTTP2)
- TCP: Typically, HTTP/2 uses TCP as its transport protocol. The well known TCP port for HTTP/2 traffic is 443 (and 80).
- Wireshark 1.12 - initial support
- Wireshark 2.0 - initial HPACK support (header decompression)
- Wireshark 2.4 - header decompression support now requires external nghttp2 package (true for official Windows/macOS builds).
Example capture file
http2-h2c.pcap - HTTP/2 via Upgrade: h2 mechanism (
curl --http2 -v nghttp2.org/robots.txt nghttp2.org/humans.txt)
Sample of HTTP2 (draft-14) - Created with nghttp2, need to use Decode as HTTP2
On the SampleCaptures page, there is also http2-16-ssl.pcapng containing a HTTP2 (draft 16) over SSL capture (with keys) and a link to a TLS 1.3 HTTP/2 capture.
A complete list of HTTP2 display filter fields can be found in the display filter reference
Show only the HTTP2 based traffic:
You cannot directly filter HTTP2 protocols while capturing. However, if you know the TCP port used (see above), you can filter on that one.
Capture only the HTTP2 traffic over the default port (443):
tcp port 443
RFC 7540 Hypertext Transfer Protocol version 2
RFC 7541 HPACK - Header Compression for HTTP/2
HTTP/2 Implementations Official page with all HTTP2 Implementations
Imported from https://wiki.wireshark.org/HTTP2 on 2020-08-11 23:14:49 UTC