I browsed a lot of data (lets say visited 30 websites) and saved all the traffic in tcpdump using wireshark. I want to know the caching time(max age) for all the objects in all the websites. Is there any smart way to accurately get caching life for the objects?
Issue: In http response when you get the caching age it just tells you the file type, how we can relate to each response with the correct request.
Thansk
Apply a display filter:
http.request_in || http.response_in || http.cache_control
Add columns.
Select in the Packet Details pane: http.request_in
Right-click and select Apply as Column
Repeat those steps for "http.response_in" and "http.cache_control".
Export the displayed packets to a .csv file to get an overview.
Go to File
Export Packet Dissections
as "CSV" (Comma Separated Values packet summary) file...
Packet Range:
select All packets
Select Displayed
Hope this helps.
Edit (see comment): find http.request_in
Apply a display filter:
http.request.method == "GET"
Select a packet
Go to the Packet Details pane
Right-click on Hypertext Trasnsfer Protocol
Select Expand Subtrees
Look for [Response in frame: ]