Hello, guys, and welcome to the second video of this chapter
while the bug in particular problem, sometimes you may have to analyze the
protocol, traffic going out, coming into your machine.
Wireshark is one of the best tools used for this purpose.
So in this video, we will explore that possibility with
Wireshark and learn how to play display filters so we can filter out
the unwanted results from the network capture and focus on the desired ones.
Once you have opened to Wireshark, you have to first select a particular
network interface of your machine and just start capturing
the traffic that you would like to explore for the purpose of this tutorial.
I have already captured and saved some network traffic that we are going to use
in order to understand how to apply display filters.
So we are going to use this one.
So as you can see, I have loaded the pick up file that I saved
in particular for this tutorial so we can explore the filters.
So let's just go ahead and start with the first one.
So the first one we are going to explore
is the source IP filter, so source IP filter
can be applied to restrict the packet viewing Wireshark to one of those
packets that have a source IP as mentioned in the filter.
So you can just go ahead and apply.
Let's say that we would like to see all the results with the source IP of.
This IP, so you can just go ahead and the display filter.
And type IP dot src equals equals
and then you type the IP address
that you would like to focus the results upon, which is the source IP in this case,
we selected this IP, so let's go ahead and type this IP.
And hit enter and from the moment that you hit Enter the
filter categorizes all the results by this source IP that we type.
So you can see if you just scroll down,
you see that the source IP is the one that we selected and we can just go ahead and
explore or investigate the traffic coming out of this IP.
So the second filter that we are going to explore is the destination IP filter.
So this IP filter can be applied to restrict the packet view towards packet
to have a specific destination IP that we would like to check the traffic from.
So that in the same manner you can go to
the display filter section of Wireshark and apply
and right in this location ip dot tsd equals equals and then you type the
destination IP that you would like to see the traffic going to, let's say
in the situation we are going to choose this IP and go ahead and to supply under
and then you will see that all the results have been categorized by
the destination IP that we wrote on the display filter.
So.
In the same manner as before, you can just go ahead and explore all the IP.
And explore all the traffic that is destined to that IP address.
Also, it is very easy to apply a filter for a particular protocol that you would
like to see traffic, so you just go ahead in the display filter
and type the name of that protocol that you would like to see the traffic for.
So let's just go ahead and type HTTP and see the traffic, only the
HTTP traffic, only the HTTP traffic that we have in this that will capture file.
So as you can see, all the results have been filtered out by the HTTP protocol.
So we see all traffic
from all sorts of source IP's and destination IPS using the HTTP protocol.
You can also use conditions in the filter.
Using the or condition in the filter helps fit in the packets get
that much, either one or the other condition that we are going to set.
So let's say that there may
arise the requirement to see packets that either have protocol, let say, HTTP or ARP
in that case, or you cannot apply separate filters.
So it exists.
These all conditions that we are going to
see now, how we are going to write and that it expresses the or
condition to display the results, matching one or both the conditions.
That is also possible.
So let us go ahead and see an example and try let's say that we would
like to filter out the results of our network.
Let's say that we would like to see let's say that we would like to filter the
HTTP or ARP packets from this network up to that we have in front of us.
So we are going to go ahead and type HTTP.
As we said, we would like to see either HTTP or Arp or both.
So HTTP, then you apply these double bars and then you type ARP.
So this is the condition, which means also we are going to filter
our results by hitting enter type in this HTTP double bar arp.
And the results will include HTTP or ARP
traffic or both if they exist in that, that will capture the file that we have.
So let's just go ahead and hit enter.
And you will see that the only results that we see are ARP.
Protocol, traffic and HTTP protocol traffic, because
this network captured file that we have included both the protocols.
You can also apply the end condition in
the filter, so these filter help you filter the packets that match
exactly the conditions that you are going to type in the display filter.
So let's say that, for example, there is
a requirement to filter the HTTP packet that have the HTTP packets
that have a specific source IP so just go ahead and use this filter and type HTTP.
And and then we would like to write the
source IP that we would like to see the HTTP traffic coming from
so we can go ahead and type IP dot src equals equals.
And then we are going to choose like
IP from our from our traffic that we captured.
So let us go ahead and type an IP address.
Then we hit enter and then we will see all the HTTP traffic.
That originated from the IP that we typed in the filter.
So it's a short result you can see,
because both the conditions are met and we see the HTTP traffic
is originated only from that from that IP address, you can also filter by port
No.
And this can be applied in the filter
by typing TCP dot port eq
80, so this basically means that we would
like to see the traffic coming from the port
80, so TCP TCP dot port equals 80 just hit
enter and then you will see all the
traffic that is going into our port 80 and also leaves our port
80 to communicate with another destination, IP source.
We can also retake packets, based on a
source IP or destination IP, and we for this with this filter.
We are just filter out all the results
from Bot coming in or out from a specific IP address.
So let's just go ahead and let see filter out the results that they have
a destination IP that we are going to choose later on.
So let us type IP dot dst, which is the
IP, the destination IP and then exclamation mark equals.
And then the IP address, so we would not like to see
the traffic destined to that IP address and we hit enter.
So after we hit enter,
we can see that all the results that they have a destination IP
the destination IP that we applied on the filter, they disappeared from our results.
So we cannot see any traffic that is destined to that IP address one
nine two one six eight dot one to one anywhere in our search results.
So in this video, we learned how to apply
filters in Wireshark so we can filter out the traffic that we don't want or we want.
So we learn to filter out results by source IP, by destination IP.
We can filter out by we can filter by protocol.
We can use conditions, such as or and and in the display filter.
And also we can filter by port number, let's say that we would like to see
the traffic coming in and out of a specific port.
And also we can filter out
the results from our network traffic that we would not like to see.
Let's say we would not like to see the
any kind of network traffic going to a specific IP address.
So that's it for this video.
You can just go ahead and click on the
next video called Identifying Open, Closed and Filtered Ports with Wireshark.