Wireshark

Contents

Wireshark#

Wireshark is the operator’s GUI packet capture and protocol analyzer. Display filters narrow a capture down to the bytes that matter, by host, port, protocol, MAC, HTTP attribute, or 802.11 frame type. The table below catalogs the filters worth knowing on engagement.

Filters#

Filter

Effect

!(arp or icmp or stp)

Drop ARP, ICMP, STP noise.

dst host ff02::1

All IPv6 multicast traffic in the local network.

eth.addr, eth.dst, eth.src

Filter by MAC address.

eth[0x47:2] == 01:80

Offset filter for hex values 0x01 0x80 at offset 0x47.

ether host ##:##:##:##:##:##

Only traffic to or from a specific MAC.

frame contains traffic

All packets containing the word traffic.

host #.#.#.#

Only traffic to or from a specific IP.

host www.example.com and not (port xx or port yy)

Specific host, excluding specific ports.

http.authbasic

HTTP Basic auth.

http.cookie

HTTP cookies.

http.data

HTTP data packets.

http.referer

HTTP Referer headers.

http.request

All HTTP GET and POST requests.

http.server

HTTP Server header.

http.user_agent

HTTP User-Agent strings.

http.www_authentication

HTTP authentication.

ip

Only IPv4 traffic.

ip proto 41

IPv6 over IPv4 tunneled traffic.

ip.addr == 10.0.0.0/24

Packets to or from any address in 10.0.0.0/24.

ip.addr == 10.0.0.1

Any packet with 10.0.0.1 as src or dst.

ip.addr==10.0.0.1 && ip.addr==10.0.0.2

Conversation between the two IPs.

ip.dst, ip.src

Filter IP to destination or source.

ip6

Only IPv6 traffic.

ip6 and not ip proto 41

IPv6 native only (exclude tunneled).

net #.#.#.#/24

Traffic to or from a range of IPs.

not broadcast and not multicast

Unicast only.

port ##

Only a specific src or dst port.

port sip

All SIP (VoIP) traffic.

pppoes

PPPoE traffic.

tcp

Only TCP traffic.

tcp contains xxx

Search TCP packets for a string.

tcp portrange 1800-1880

Capture traffic within a range of ports.

tcp.analysis.flags && !tcp.analysis.window_update

Retransmissions, duplicate acks, zero windows.

tcp.dstport

Filter port to TCP destination.

tcp.flags == 0x012

All SYN/ACK packets; related to tcp.flags.syn==1.

tcp.port==4000

Any TCP packet with port 4000 as src or dst.

tcp.srcport

Filter port to TCP source.

tcp.time_delta > .250

TCP packets with delta time greater than 250 ms.

udp.dstport, udp.srcport

Filter UDP destination or source ports.

vlan

VLAN traffic.

wlan.fc.type eq 0

802.11 management frames.

wlan.fc.type eq 1

802.11 control frames.

wlan.fc.type_subtype eq 0 (1=response)

802.11 association requests.

wlan.fc.type_subtype eq 11 (12=authenticate)

802.11 authentication requests.

wlan.fc.type_subtype eq 2 (3=response)

802.11 reassociation requests.

wlan.fc.type_subtype eq 4 (5=response)

802.11 probe requests.

wlan.fc.type_subtype eq 8

802.11 beacons.

References#

Contents