"Go" Wireshark Filtering rules filter packets

Http://blog.sina.com.cn/s/blog_60a65db5010135ib.html

IP filtering: Include source IP or destination IP equals an IP

For example: Ip.src addr==192.168.0.208 or ip.src addr eq 192.168.0.208 Show Source IP
IP.DST addr==192.168.0.208 or ip.dst addr eq 192.168.0.208 Display Destination IP

Second, port filtering:
For example: Tcp.port EQ 80//Whether the port is source or target is displayed
Tcp.port = = 80
Tcp.port eq 2722
Tcp.port eq or udp.port eq 80
Tcp.dstport = = 80//target port 80 for TCP protocol only
Tcp.srcport = = 80//Explicit TCP protocol Source port 80
Filter Port range
Tcp.port >= 1 and Tcp.port <= 80

Third, protocol filtering: TCP
Udp
Cr2
Icmp
http
Smtp
Ftp
Dns
Msnms
Ip
Ssl
Wait a minute
Exclude SSL packages, such as!SSL or not SSL

Four, packet length filter:
Like what:
Udp.length = = 26 This length refers to the UDP itself fixed length 8 plus UDP The sum of the packet
Tcp.len >= 7 refers to IP packets (The block of data under TCP), not including TCP itself
Ip.len = = 94 In addition to the Ethernet head fixed length 14, the other is Ip.len, that is, from the IP itself to the last
Frame.len = = 119 entire packet length, starting from ETH to the last

Five, HTTP mode filtering:
Example:
Http.request.method = = "GET"
Http.request.method = = "POST"
Http.request.uri = = "/img/logo-edu.gif"
HTTP contains "GET"
HTTP contains "HTTP/1."
Get package contains a header field
Http.request.method = = "GET" && http contains "Host:"
Http.request.method = = "GET" && http contains "User-agent:"
The post package contains a header field
Http.request.method = = "POST" && http contains "Host:"
Http.request.method = = "POST" && http contains "User-agent:"
The response package contains a header field
HTTP contains "http/1.1 OK" && http contains "Content-type:"
HTTP contains "http/1.0 OK" && http contains "Content-type:"

Six, connector and/or

Seven, expression:! (arp.src==192.168.1.1) and! (arp.dst.proto_ipv4==192.168.1.243)

Eight, Expert.message is used to filter info information, mainly with contains to use

"Go" Wireshark Filtering rules filter packets