Which filter specifically targets HTTP responses in Wireshark?

• A. frame contains 'http'
• B. http.request
• C. http.response
• D. tcp.port==80

Answer: (C)

Focusing on the HTTP message type makes the inspection precise. HTTP responses are the server’s replies to client requests and carry status codes and headers that describe the result of each request. Using the filter that targets HTTP responses shows exactly those packets, isolating the server-to-client messages so you can quickly inspect status codes like 200, 404, or 500 and the accompanying headers.

Other options are less appropriate because they’re either too broad or not tied to the HTTP protocol. A frame filter that looks for the literal string "http" can catch non-HTTP traffic and miss some HTTP messages, since the string might appear in other contexts. A filter for HTTP requests shows only client-originated messages, omitting the server’s responses. A port-based filter like tcp.port==80 is transport-layer, not protocol-specific, and can include non-HTTP traffic or miss HTTP traffic on non-default ports.