Here in this blog we will see how to apply Filters and inspect packets. So to apply Filters in Wireshark, we have two ways:
- In the Display Filter window, at the top of the screen
- By highlighting a packet and right-clicking on the packet
Wireshark filters use key phrases as follows:
|ip.addr||Specifies an IPv4 address|
|ipv6.addr||Specifies an IPv6 address|
|src||Source- where the packet came from|
|dst||Destination- where the packet is going|
We can also use the following values:
|&&||Means “and,” as in, “Choose the IP address of 192.168.2.1 and 192.168.2.2”|
|==||Means “equal,” as in “Choose only IP address 192.168.2.1”|
|!||Means “not,” as in, do not show a particular IP address or source port|
The Filters which are valid have a green color. If there is any mistake then the box will turn into vivid pink.
Let’s start with an example of how to inspect packets using filters. Suppose we want to see packets that have only an IP address of 126.96.36.199 somewhere inside. We will create the following command line, and put it into the filter window.
Alternatively, we can highlight the IP address of a packet and then create a filter for it. Once we select the IP address, right-click, and then select the Apply As Filter Option. We’ll see a menu of additional options. One of those is “Selected”. If we choose “Selected”, then Wireshark will create a filter that shows only packets with that IP address in it.
We can also decide to filter out a specific IP address using the below filter.
Also, we are not limited to IPv4 addresses. If a particular system is active and using an IPv6 address on our network, we can open another Wireshark window and apply the below rule:
ipv6.dst == 2607:f8b0:400a:15::b
Some Additional Filters Are:
|tcp.port==8080||Filters packets to show a port of your own choosing – in this case, port 8080|
|!(ip.src == 188.8.131.52)||Shows all packets except those originating from 184.108.40.206|
|Shows all packets except those going to the IPv6 address of 2607:f8b0:400a:15::b|
|ip.addr == 192.168.4.1 &&|
ip.addr == 192.168.4.2
|Shows both 192.168.4.1 and 192.168.4.2|
|http.request||Shows only HTTP requests – useful when troubleshooting or visualizing web traffic|
Wireshark is a powerful application. For more information, you can read here.