How can I get Wireshark to show me my local HTTP Traffic? - http

Question

When I enter either this URI to call a REST method on my running Web API app:
http://SHANNON2:21608/api/inventory/sendXML/duckbill/platypus/someFileName // using Hostname of local machine
--or this one:
http://192.168.125.50:21608/api/inventory/sendXML/duckbill/platypus/someFileName // using IP Address of local machine
...in Postman (using HttpPost, and attaching an xml file) and run it, on examining it in Fiddler 2, I see this error in Fiddler's Inspectors.WebView pane:
Bad Request - Invalid Hostname
--------------------------------------------------------------------------------
HTTP Error 400. The request hostname is invalid.
Note: I get that error even though I do hit the breakpoint in the corresponding Controller REST method on the server.
Trying to examine further exactly what's happending (what HTTP is being sent), I run Wireshark and see only this for destination of my IP Address:
...and this with my IP Address as the source:
Why are there no HTTP Protocol entries? The HTTP is apparently being sent, because I am hitting the breakpoint I've set on the first line in the server Controller method:
[HttpPost]
[Route("api/inventory/sendXML/{userId}/{pwd}/{filename}")]
public async Task SendInventoryXML(String userId, String pwd, String fileName)
{
Task task = Request.Content.ReadAsStreamAsync().ContinueWith(t =>
{
var stream = t.Result;
using (FileStream fileStream = File.Create(String.Format(#"C:\HDP\{0}.xml", fileName), (int)stream.Length))
{
byte[] bytesInStream = new byte[stream.Length];
stream.Read(bytesInStream, 0, (int)bytesInStream.Length);
fileStream.Write(bytesInStream, 0, bytesInStream.Length);
}
});
}
So why is Wireshark being so secretive about showing me the HTTP sent? Is it turning a blind eye to that internal communication and, if so, how can I "unleash it" to show me that?
UPDATE
Aha / Voila! A combination of Postman, RawCap (http://www.netresec.com/?page=RawCap), and Wireshark seems to work. I promptly ran the newly-discovered RawCap from a command prompt with this verbiage:
RawCap.exe 192.168.125.50 captured.pcap
...then called the REST method from Postman, and opened the resulting file that RawCap created (captured.pcap in my case) in Wireshark, and it shows me some HTTP traffic:
Some more detail about the HTTP call can be seen here:
What I don't know is how to "shut down" RawCap gracefully.
UPDATE 2
RawCap/Wireshark tell me it's a Bad Request (which I already knew was the response):
...but I see nothing to give me a clue about why it's considered a bad request
UPDATE 3
When I try to call my REST method from Fiddler Composer with all the various forms of "local" (hostname, IP Address, "locohost"), I never reach the breakpoint in the server; I get err msgs prior to that (404 for locohost, 400 for all others):

Answer 1

Typically, Invalid Hostname means that the HTTP request's Host header contains a value that is not bound to any site on the web server. For instance, you're using an IP address as the host, but if your server is only configured to accept a machine name (e.g. mybox) then you will see a HTTP/400 from the server demanding that you supply a proper hostname.