Wireshark-Filter Rules

When using the default settings of Wireshark, you get a lot of redundant information so that it's hard to find the packets you need. Using filters can help us quickly find the packages we need in a very complex and complex result. Filters are divided into two types: Capture filter and display filter.

The capture filter is used to determine what information is recorded in the capture results and needs to be set before the packet is caught. A capture filter is the first layer of filtering that data passes through to control the amount of data that is captured to avoid generating too large log files.

The display filter is a more powerful and complex filter that can be used for detailed lookups in the capture results to help us quickly locate the packets we need in the log file.

Capture Filter Syntax

protocol[direction][Host (s) [value][Logical_operator other_expression]

Operation

Click the Capture menu bar, select Options ..., and open the Capture Options window to edit the filter expression.

Instance

A) The packet that displays the destination TCP port is 3128.

TCP DST Port 3128

b) display packets with the source IP address 10.1.1.1.

IP src host 10.1.1.1

c) A packet showing the destination or source IP address is 10.1.2.3.

Host 10.1.2.3

d) display packets from UDP or TCP with a port number within the range of 2000 to 2500.

SRC Portrange 2000-2500

E) Displays all packets except ICMP.

Not IMCP

f) Display the source IP address is 10.7.2.12, but the destination is not a 10.200.0.16 packet.

SRC host 10.7.2.12 and not DST net 10.200.0.16

Display filter Syntax

protocol[.str1][. str2][comparison_operator value][Logical_operator other_expression]

Operation

1. Edit location:

2. You can click Expression ... button to open the Filter Expression window to edit the filtering expressions:

Instance

A) displays the TCP packets.

Tcp

b) display packets except ICMP.

Not ICMP

c) display packets with the source IP address 93.184.216.34.

IP.SRC = = 93.184.216.34

d) display packets with a destination IP address of 93.184.216.34 and a destination TCP port of 445.

IP.DST = = 10.6.0.30 and Tcp.dstport = = 445

e) Display HTTP packets with a source or destination IP address of 10.1.1.1.

Ip.addr = = 93.184.216.34 and http

f) The HTTP packet containing "example.com" is displayed in the host header.

Http.host contains "example.com"

h) shows packets with a data frame length not greater than 1024 bytes.

Frame.len <= 1024

Wireshark-Filter Rules