See below picture to find out HTTP which resides under application layer.

HTTP is an application layer protocol in ISO or TCP/IP model. This is a very simple example, but these techniques can be applied to dissect any PDU.First is all the full form of HTTP is HyperText Transfer Protocol. We do this by selecting Edit->Preferences->Protocols>DLT_USER->Edit Encapsulations Table and adding an entry to decode link-layer header type value 147 using the http dissector: We can fix this by telling Wireshark how to decode our user link-layer header type. We can now open the file in Wireshark, but the contents aren't recognized as HTTP if user link-layer header type 147 is not configured: Valid user link-layer header type values are in the range 147 - 162 (USER0 - USER15). The -l 147 argument to text2pcap specifies DLT USER0. Od creates a hex dump of the data, which is the format that text2pcap expects. We can do this using od and text2pcap: od -Ax -tx1 -v /tmp/cnnheaders.txt | text2pcap -l 147 - httpresp.pcap

Creating the Capture Fileīefore we can dissect our data we need to convert it to a libpcap-formatted file. The libpcap file format is one exception to this - it specifies a reserved set of link-layer header type that can map to any protocol. Which link-layer header type corresponds to which protocol is normally determined in advance by the creators of each capture file format. Otherwise, it won't know if it should start parsing the data as Ethernet, PPP, 802.11, or any of the other supported protocols. When Wireshark reads a capture file, it needs to know the link-layer header type (LINKTYPE_ value) of the lowest-level protocol for each packet it reads. How do we dissect this data in Wireshark? Link-layer Type Values

If we try to open the dump file directly we get an error message. Now suppose we want to display the headers in Wireshark. We end up with a header file that looks like this: HTTP/1.1 200 OK Suppose we've dumped the response headers of an HTTP connection using curl: curl -dump-header /tmp/cnnheaders.txt > /dev/null This HowTo shows how to use the user link-layer type feature in Wireshark to decode any arbitrary protocol data. Wireshark supports lots of link-layer protocols in lots of file formats, but it doesn't support everything.

Wireshark filter http 200