Common Wireshark filter commands

We use Wireshark to capture packets, but we do not know how to analyze these packets. We cannot extract the data we need from a large number of packages. The following describes the wireshark filtering rules.

1. Filter source IP addresses and destination IP addresses. In the filter rule box of Wireshark, enter the filter conditions. For example, find the package whose destination address is 192.168.101.8, IP. dst = 192.168.101.8, and IP. src = 1.1.1.1;

2. Port filtering. For example, if port 80 is filtered, enter TCP. Port = 80 in the filter. This rule filters out both the source port and target port 80. Use TCP. dstport = 80 to filter packets whose destination port is 80 and TCP. srcport = 80 to filter packets whose source port is 80;

3. Protocol filtering is relatively simple. You can directly enter the protocol name in the filter box, such as filtering the HTTP protocol;

4. Http mode filtering. Such as filtering get packets, HTTP. Request. Method = "get", filtering post packets, HTTP. Request. Method = "Post ";

5. The use of the connector and. When filtering two conditions, use and connection. For example, if the IP address is 192.168.101.8 and the IP address is HTTP, IP. src = 192.168.101.8 and HTTP.

Common Wireshark filter commands