How can you identify HTTP responses with client-side or server errors?

• A. Filter by dns.query.type TXT.
• B. Filter by tls.handshake_type ClientHello.
• C. Filter by http.response.code == 200.
• D. Filter by http.response.code >= 400.

Answer: (D)

HTTP responses carry status codes that show how the request was handled. Codes in the 4xx range indicate client-side problems, and codes in the 5xx range indicate server-side problems. To identify error responses quickly, use a filter on the HTTP response code that selects 400 and above: http.response.code >= 400. This captures both 4xx and 5xx responses, which is exactly what you want when diagnosing errors. For example, a 404 or 500 will match, while a 200 (OK) or a 302 (redirect) will not. If you need more precision, you can narrow to client errors (http.response.code >= 400 and http.response.code < 500) or server errors (http.response.code >= 500). Other filters like DNS TXT or TLS ClientHello aren’t related to HTTP error statuses, and filtering for 200 would miss actual errors.