Hello everyone in this video. You will learn the different
filtering techniques.
At the beginning we will work on the capturing live Network traffic
and let's begin to filter out
our packets on the five Network traffic.
We will first make filtering
before capturing the network traffic
and we are going to open the capture options
window.
In this window, you can see the compiled selected
PPS.
this button
vpf is an acronym that stands for
Berkeley packet filters syntax.
So and it is applied to all of
the filters you select for capture. It
is critical because this is what will allow
the computer to understand whatever you
create and how those filters are
used in the Wireshark and
after selecting the interface to
capture Network traffic.
And I will choose the Wi-Fi interface.
And after selecting the interface to
capture Network traffic. There is a filter field. You can
see enter a capture filters.
On this Pane and there's
a filter field in this window.
We may enter our filter here and then
begin the capturing process as a
result on the packets that matching the
filter the determined are collected and
stored. Let's go ahead
and click on the bookmark icon.
and in this icon, you can
see some manage saved
bookmarks, so
And when we are when we are
clicking on this button this bookmark button,
you can see the manage captured
filters.
So we will select this button this Choice. Sorry
from the
drop down menu.
And we selected.
This window will come to us so pre-recorded
and ready-made
basic filtering is shown here.
As a result even someone who has never used
a capture filter May understand it.
And to escape receiving broadcast and multicast
packets. For example, we may
use the not broadcast and not
multicast filtering.
We can we can make a filtering
to escape receiving some
broadcast and multicast spec packets
by this filtering. So
as a logical operator do not
operator do not operator is
used here the mean with using
this operator. We
mean will not broadcast when we
say that.
So the same is true, the same is true
for multicast and we
used and comparison.
And we used and comparison operators to
satisfy both of these conditions.
We may use.
And operators for this
purpose. We may also utilize C
like operators such as not and
and so instead of not we
may use an exclamation point and
a double and symbol
instead of these operators we
can use that.
Justice, so the exclamation point
is enough instead of
not.
word and you can use again instead
of not
the exclamation point like this
and we are clearing the spaces.
Okay, and then you can use.
And double and symbol.
so you can
you can write a double and
symbol instead of
the word and
and these symbols are used
instead of the word versions
and these symbols are C
like versions of The
Operators that we
have used for the filtering.
And this filter expiration is the same the
previous one.
And you can use like this.
In this window, we can also add our own filtering
phrases, press the plus
button.
And let's create a filter that will only
capture incoming and outgoing packets
from my own IP address.
So let's look at our IP address firstly.
As you can see my IP address is 192.168.0.10.
So
I will use this IP address
as my IP address is my
for my filtering code.
And now I'm writing my filtering expiration.
for my IP address
and
for name
terrific on my IP as the
printing name.
And that's it.
Now, let's create some filtering to capture
packets with only this IP address as their
Source address.
to do this
we start with SRC.
And with SRC we mean
which stands for source source
IP address we will
specify.
And to specify the source host IP address
we can we can write
Source host.
and then IP address
and this is enough to make a filtering.
To capture some Network packets
with only source IP
address.
Let this filtering be named from my
IP.
The only capture outbound traffic from this IP
address using this filter now, let
us now build filtering to catch packets
with only this IP address as they
are destination address and do this.
We begin with DST which
stands for destination.
and host
and then again IP address
so let this filtering be named to my
IP.
And we only capture traffic to this
IP address with this filter.
And as you can see, we may provide the port.
in a provide some ports and we
may provide Samples used
by that protocol for example,
HTTP or at an
another protocol as
DNS and to capture
just traffic in part in particular protocols
by using a capture filter
like this and
to capture only DNS packets. For example,
we can write a filter like
this.
only the port
53
you know the port 53 is
used for the DNS protocol and you
can use this filter to capture only DNS
packets and we can give a
name as
only DNS
So that's it. And as a
result, we only see packets coming and going
from Port 53. They use
port 53 since the DNS protocol
runs on that part and we can
directly filter TCP UDP
and IP.
and ARP also
we can use and airp protocols
by their names.
You can see.
And for the other protocols we have
to we have to specify the
port their ports to make a
filtering for the other protocols and
the filters for these protocols for
TCP and
UDP and arp.
Are already available in the capture filters
window?
So to generate these treatable filtering
for our purposes. We must pay spatial
attention to the filtering syntax. And now
let's do capturing using one
of the filters we created.
We have three filtering in
here. Now. We have created.
We will choose the entire face as Wi-Fi
and here when
we click on the bookmark sign.
We can now see the filter.
That we have added.
On the DNS to my IP from
my IP and traffic on my IP.
We have created these filters.
And I will choose first the filter
of traffic on my IP.
And they start to the capturing process.
Network packets started to drop because some programs
that I am running active in
the background are using the internet and you
can open the command line
window and you can send some
pink packets to google.com or wireshark.org
websites, or you
can go to these websites on your browser in
order to create some HTTP packets,
but I don't need
to do these operations because I
have already some packets
on my network.
And that's enough for now and I
am stopping the capturing process.
as you can see the package that we have now are coming
from only the IP address that
we have specified in
the filter and or the
packets are
Going to this IP address or coming
from this IP address and that's
why we only see this IP address
as the source or destination
IP address on this
PK file now, let's try another
filter to to capture
some packets on my network.
And I'm closing this pick a
file firstly.
Close this and continue without saving.
And again, we will start a
capture.
and
in this step now, I will
choose another filter.
We have chosen the traffic on my
IP filtering last one
in last one and now I will choose
the from my IP filtering. So
I will see the packets only sourcing
from this IP address.
And I have chosen this IP this
filtering and start.
now as you can see
the only see
this IP address is the
source IP address.
So that's enough for now. Again. We
are stopping capturing packets.
And let's try another one.
In this time, I will choose the from my
IP address.
Sorry to my IP address as the
destination IP
address.
And I will use this filtering.
While we are capturing some packets.
So click on the start.
continue without saving
that's enough and we can stop.
the capturing and in this
time you can see the IP address
as the destination IP address
only so there is
no, IP address except
that IP address we have specified before in
filtering expiration.
We are seeing only this IP
address as the destination IP
address, so that's okay now.
Now, let's review the capture filter syntax structure again.
The words we will use to define
the scope.
or the scope
are host
Or net which means Network you
can specify the network address before
capturing process. And
the other one is the
port range.
Port range
or you can use port word.
of as well
So you can specify a port range
using the port range
word the port range
expression and to determine
the direction.
You can use.
You can use the words SRC which
means source.
and the DST
which stands for destination?
And you can use these words for determining
the direction the traffic
direction and finally.
Finally the words we
can use to indicate the protocol.
eater for ethernet
And VLAN.
to specify the sum
vlans
and IP
and
IP version 6
And ARP for our protocol.
and read and are
our
for the other protocol which means
reverse ARP
reverse are protocol and
the TCP.
again
we have seen before in the capture filters window
and
lastly UDP
You can use these words to specify
the protocol to directly
specify these
protocols. And if
you want to specify some other
protocols, you must
use the port numbers for example
if you use to
If you want to specify the DNS
protocol, you must enter the
port number of
the DNS as 53.
So that's okay about the capturing filters.
The second filtering option is display filter
in this section. I will use
a pickup file that I have downloaded from the
Wireshark website, you know, why shark.org
and now
we are opening that file in Wireshark firstly.
And the PK file
is HTTP with gpags
DOT cap.
So and this capturing file has some traffic
with HTTP protocol.
Keep in mind that display filters are
used while the capture is running
and after the capture has stopped.
So if you have already a pickup file,
you can use display filter.
You can use some display filters. So let's
see some examples previously written in Wireshark
and under the analyze menu.
You can click display filters.
In this window, we can see some of the expressions in
capturing filters.
For example in addition to protocol filters
such as IP.
And TCP and the UDP.
You can see that expressions using
logical operators such
as not ARP not
our used here.
As in capture filters
window and in addition to
this to the expressions in
the capture filtering. We should know that here.
We can also filter other protocols by name.
For example, you can use
the HTTP name for
the filtering and
For example, we can
use the DNS as
protocol name to make
a filter. And now let's
enter a filter to see only HTTP packets
in the display filter
field.
If you type http.
and
put a dot you will see it automatically suggest
any parameters that may be
present in a in an HTTP packet or
message. For example, let's look at
this HTTP packet.
In this HTTP packet, we have some
Fields some parameters such as
except host user agent.
And when we click to the
display filter field again, and when
we put the dot syntax.
You can see the some parameters. You
can see some parameters such as except server
or such as
chat and request.
For example, you can see the request parameters
and user agent.
As well you can see.
So we can understand that all parameters in
this packet in an HTTP packet
are also suggested in the display filter
area.
If you if you put a dot
syntax, you can see.
this suggestions about the parameters associated with
the HTTP protocol and
when we used those Syntax for the except parameter
here, for example
You can you you can you can see
that. It's suggest here as well does if
you are looking for an HTTP packet
with a specific parameter value, we can
specify it in this way and filter
it to search whether there is such a packet. For
example this packet this
packet contains a get method.
as the HTTP method you can
see in here and
V type V type
we can type http.request to
see all HTTP request packets.
And let's look at this.
now dot request
we are writing dot request.
With this filtering, we will see all the
request packets on http.
Let's click enter.
And as you can see now we have
all request packets associated with
HTTP protocol.
we have
19 packets you can see
in the status bar.
So we see all requests and
if you are searching for a specific request
method we can type this.
http.request dot method
and then we will add an operator
and comparing operators.
this operator is
is equal to operator maybe you
know, the double equality sign means
is equal to
This sign means is equal
to and is equal to operator will
compare the HTTP methods
in the packets with the
value. We will give it.
For example, I will give the method.
get
in this situation is equal to operator will
compare.
the HTTP methods in the packets with
the value get
so we will find the ones
that contain get.
And you know that HTTP request methods
can be get paused put or page
now click on the enter to see
the only get methods in the
packets.
When we click on the enter now, we have only packets
which contain the
get method.
There's no other methods with the
packets. You can see in here.
We have only get packets now.
For example, if we are looking for a packet containing
the post method we type
HTTP request method is
equal to post.
and hit enter
and as you can see as a
result, there is only one
packet contains postmet, but if
we change it to get
again
and hit enter
we have 18 packets with the
get methods.
We can see the get request packets here.
Now I will show you how you can
easily do the same filters as someone who
doesn't know any filtering.
Who who has any filtering
information and this
method is the easiest way to make
filter. For example, if you
want to see only the packets with the source IP
address of 10.1.1.1. We
will we will choose this
way to make this.
Firstly I will clear this filtering.
and then
I will take a packet with the
source IP address 10.1.1 dot
one and click on
this packet and and then
we will expand the Internet Protocol
version 4 heater.
And in here you can see the source address field
Source others perimeters, and we
will use this parameter.
And let's right click on Source address.
And apply as filter.
And the selected let's click selected.
as you can see
in the display filter field and the packet
paint in the packet
paint. Our filter
has been prepared and applied automatically.
Now, let's say we
want to see only the packets with 200
HTTP code and
OK message from the package
coming from this IP address.
We can't we can do this in
this way. Let's click on
a packet with the message. Ok.
And let's go.
To the packet details Pane and
let's expand the hypertext
transfer protocol field.
And we are going to the HTTP response.
So let's right click on the HTTP
appearance response.
And then when we
come to apply as filters, we will
click and select it.
Because we want our new condition to
be met with the previous one. If
you want to filter you have prepared to be
written in the display filter
and make some change
instead of applying it
directly. You can do the same with prepare
as filter option. So
I will I will use the prepare
as filter and the this
time not apply as filter. I will
use the prepare as filter and
lead and selected because
I want to save the last
the previous condition which IP
stores is equal to 10.1.1.1 and
I will choose the
end selected just we
have prepared.
Filtering expiration, but we didn't
apply yet.
And let's enter this filtering now.
As you can see there are now decades that
contain only OK answers.
Okay responses instead
of using corresponse number.
In here response number we can
use another option. Let's use
in here http
Dot
response
You will see the response parameter.
And Dot response dot code
perimeter that I want
to use.
So HTTP dot response dot code will
be 200 because
I want to see the packets with
the response 200.
code and I will
make equal
to 200 my response
code.
Now we see that.
the filtering
And we see that we get the same
result so you can you can
choose this way instead of
the HTTP response number
suppose. We want to
see packets associated with Apache server some
Apache servers for this. It
is necessary to find packets containing Apache
in the server information.
You can see in here. For example in this packet. The
server is an Apache server. You
can see the information about server in
this parameter and you
can see this is a Apache server
and Reddit Linux.
Now we will type A filtering expiration
with the HTTP server
and This
Server field This
Server perimeter will contain Apache.
And to do this we can type
http.
Dot
server and
it has already suggested automatically.
and HTTP server will contain Apache
so
to specify that
we can use.
contains keyword
as you can see contains filter.
and I want to
right
the name of the server
as Apache
so now click on the enter.
And you can see the 10 packets.
Which contained Apache server?
The contains filter has a case sensitive
feature if the uppercase or lowercase
feature of the value of the entered in here.
This in display filter field if it
isn't the same as in
the packets.
Is in the packets, it will not find
it. It will not find the packets that
the name of
some with this some with
some uppercase letter or
with the combination of upper is
letter and the lowercase letters.
It can't find in this
situation. If we
don't if you don't enter the name
properly, so the
contains the contains
filter as a case active
feature keep in
mind that because it is important to find
pecans packets so we
can use some of
the methods such as upper or
lower to overcome this problem.
If you do upper we use
upper method we can write this.
like this
upper
and making parentheses
if you use the upper method
it will it will capitalize the HTTP server
information?
So it will make the all
letter in uppercase
and this word
Apache.
You can see the this will in
a format with a uppercase so
we will.
right
with
the letter in uppercase
and we can
search now.
So you can see we have
the same result.
By the upper method and also
you can use the lower method with
the same logic.
and if you use lower
in here
you will.
make lowercase
You will make lowercase.
As you can see we have the same result
now.
So another filter is called matches. The matches
filter has a case insensitive feature.
That's right to filter. We wrote before with
matches now.
And I will write.
http
server
and instead of contains
filters
I will write matches.
So next filter will be
applied now, so it isn't important how
you write the server name
you can write with the lowercase or
uppercase or with the
combination of them that isn't
important for the matches filter. It
will find the packets which
contain Apache to for
us and now click
on and enter as you
can see the same result that we
have in the Packers pain.
We have 10 packets and
they are containing Apache
name as the server
name and we have written
with the lowercase.
The server name because the matches filter
as a
case insensitive feature.
So that's all and we can use the
in filter to see terrific on
only on certain parts.
For example, if you want to see the traffic
on TCP ports 80 and 443
and
8080, you
know, these ports are some HTTP
ports.
We can write in.
filtering field
like this
TCP port
in
so if you will specify more than
one ports, you will
use these curly braces like
in this way and you
will enter your ports in these curly
braces, and I
will enter my port number.
and the other one will be
443 and the
last one
Is 80 80?
So I want to see the traffic on these TCP
ports.
And click on the enter.
So we can see the packets with any of the ports the
entered in filtering as
both.
the destination port and the source Port you can
see
both of them we can see now.
So we will meet again on the next video and we
will discuss about the protocol details
and Analysis.
See you on the next video.