Why is Wireshark not capturing certain POST requests?

HTTPS encrypts the contents of the message from anyone snooping on the wire - which is exactly what you are doing - so it's working as intended. Anyone doing packet captures anywhere between the browser and webserver just see encrypted traffic.

Wireshark isn't the best tool for analysing HTTPS traffic. For that, you can use the debugger built into the browser, or something like Fiddler, which runs as a proxy server on your machine and decrypts HTTPS traffic.

Fiddler does this by sitting in the middle - the webserver is having an HTTPS conversation with Fiddler, and your browser is having an HTTPS conversation with Fiddler. But Fiddler is able to decrypt both connections. This will of course throw up scary invalid certificate warnings unless you add Fiddler's CA certificate to your browser/OS.

Wireshark WILL work if you have the SSL private key file. So if you are on the webserver end of things, load your SSL private key into Wireshark and it will decrypt the traffic for you. This only works if you have access to the private key - you won't be able to decrypt traffic to/from stackexchange this way, but you can use it for web servers you control.

Now that you've clarified the traffic is from your webserver to a third party, I have another option for you, if you are on Linux or Mac: mitmproxy

Either fiddler or mitmproxy should be able to do the man in the middle decryption for you. The tricky part is getting the data to pass through the proxy. On linux this is relatively easy using iptables - the mitmproxy gives setup instructions for that. On both windows and linux you should be able to use Apache's mod_proxy ProxyRemote settings to direct traffic to your proxy server.


It might be because the other side is using HTTPS.