wireshark cmd
ip.dst==192.168.6.58
ip.src==192.168.6.58
ip.dst==192.168.6.58 and http
ip.dst==192.168.6.58 and ssl
up vote
20
down vote
Filtering IP Address in Wireshark:
(1)single IP filtering:
ip.addr==X.X.X.X
ip.src==X.X.X.X
ip.dst==X.X.X.X
(2)Multiple IP filtering based on logical conditions:
OR condition:
(ip.src==192.168.2.25)||(ip.dst==192.168.2.25)
AND condition:
(ip.src==192.168.2.25) && (ip.dst==74.125.236.16)
The filtering capabilities of Wireshark are very comprehensive. You can filter on just about any field of any protocol, even down to the HEX values in a data stream. Sometimes though, the hardest part about setting a filter in Wireshark is remembering the syntax! So below are the top 10 display filters that I use in Wireshark. Please comment below and add any common ones that you use as well.
1. ip.addr == 10.0.0.1 [Sets a filter for any packet with 10.0.0.1, as either the source or dest]
2. ip.addr==10.0.0.1 && ip.addr==10.0.0.2 [sets a conversation filter between the two defined IP addresses]
3. http or dns [sets a filter to display all http and dns]
4. tcp.port==4000 [sets a filter for any TCP packet with 4000 as a source or dest port]
5. tcp.flags.reset==1 [displays all TCP resets]
6. http.request [displays all HTTP GET requests]
7. tcp contains traffic [displays all TCP packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID]
8. !(arp or icmp or dns) [masks out arp, icmp, dns, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest]
9. udp contains 33:27:58 [sets a filter for the HEX values of 0x33 0x27 0x58 at any offset]
10. tcp.analysis.retransmission [displays all retransmissions in the trace. Helps when tracking down slow application performance and packet loss]
Recent Comments