Wireshark technique-filter rules and display rules

Wireshark is a powerful network protocol analysis software, the most important of which is free software.

Filter rules

Only eligible packets are captured. When Wireshark captures packets through winpacp, it can filter out non-conforming packets to improve our analysis efficiency.

If you want to fill in the filter rules, find capture-> options in the menu bar. The following dialog box is displayed. Fill in the corresponding filter rules in the capture filter input box. Click start below to apply the filter rules.

1. capture only HTTP packets

TCP port 80

Resolution: The above only captures packets of port 80 in the TCP protocol. Most Web sites work on port 80. What if port 81 is encountered? You can use the logical operator or! For example, TCP port 80 or TCP port 81

2. Capture ARP packets only

Ether proto 0x0806

Resolution: ether indicates the Ethernet header, and proto indicates that the proto field value of the Ethernet header is 0x0806. The value of this field indicates that it is an ARP packet. If the IP packet value is 0x8000

3. Only capture communications with a host

Host www.cnblogs.com

Only capture the communication with the blog garden server. SRC indicates the source address, and DST indicates the target address.

4. capture only ICMP Packets

ICMP

For more information about filter rules, refer:

Http://www.tcpdump.org/tcpdump_man.html

Display rules

Only the captured packages are filtered and displayed.

Add the corresponding rules in the input box below and click Apply. To clear the display filter, Click Clear.

1. Only Show http packets

TCP. Port = 80

2. Only ARP packets are displayed.

Eth. type = 0x806

You may say that the values following the type cannot be remembered. It doesn't matter. You can click expression to bring up the filter expression window, for example:

3. Only display the communication with a host

IP. ADDR = 42.121.252.58

4. Only show ICMP Packets

ICMP

It's common in learning, and it's recorded.

Wireshark technique-filter rules and display rules