Finding X-MS-PolicyKey in a trace

Wireshark
1

How would I find “X-MS-Policykey” in a trace?

Would I enter as a display filter:

http contains “X-MS-PolicyKey”?

or would I:

Press Ctrl + F and then enter “X-MS-PolicyKey”

I am not seeing this in an AS trace, but I wanted to make sure that I was not searching incorrectly.

2

Actually, I used this display filter:

http contains “Microsoft-Server-ActiveSync”

Then, I kept clicking on entries that appeared right around the time I did the sync on the device. I had to do this since there was a lot more traffic then just my device using ActiveSync.

I expanded the WBXML “+” sign. Then, I expanded the “data” “+” sign. I could see the “sync key” then.