In the last lecture we've seen how useful is Wireshark for troubleshooting network problems or
isolating security incidents.
Unfortunately, the amount of information you will get when capturing packets can be overwhelming.
Capturing so many packets means that you will end up seeing a huge amount of packets. Thankfully,
Wireshark allows us to quickly filter all that data, so you only see the parts you’re interested
in, like a certain IP source or destination address, tcp port and so on.
The filtering capabilities of Wireshark are very comprehensive.
You can filter on just about any field of any protocol.
Let's start to Wireshark and then capture on the eth0 interface, on this interface.As root
I'm starting
Wireshark.
Now
Wireshark is kept capturing data.
And I'm generating some traffic. I'm refreshing a web page to generate some https or http traffic. I'm
using the dig command to generate DNS traffic and I'll ping a random IP address, like say the DNS server
of Google.
The most basic way to apply a filter is by typing the name of the protocol you want to see in the filter
box at the top of the window and clicking apply or pressing enter.
When you start typing why a shark will help you autocomplete your filter.
For example I'm typing DNS and I'm seeing only DNS traffic.
Or icmp and it's displaying only icmp packets; the ping is still running. We can see the packets in real
time.
That's a very basic filter.
You can also click Analyze > Display Filters to choose a filter from among the default filters included
in Wireshark. I'm removing the filter and I'm stopping the capture. Another interesting thing you can
do is right-click a packet and select Follow > TCP Stream.
You'll see the full TCP conversation between the client and the server. This gibberish is encrypted data.
Notice that the filter has been applied automatically.
Wireshark is showing you the packets that make up the conversation, that https conversation. Let's
continue with some of my preferred filters; for exampleip.addr = = and an IP address
That sets a filter for any packet that has that IP addressas the source or the destination IP address.
This is very useful if you want to analyze specific traffic.
You can also use not equals operator, which is an exclamation mark, and the equal sign to negate
the filter, like this:
We are seeing all packets that do not have that IP address as source or destination address; or you
can use ip.dst to filter only by destination or
ip.src to filter by source like this:== let's say 104.16.121
145
We are seeing only the packets sent to that destination.
And you can use tcp.port and udp.port to filter by ports.
For example I want to see only packets to or from port 443 which is
https.
And you can add the logical end operator which is && to add
another condition like say I want to see packets to port 443 if
the destination ip address is a specific one, like this: && ip.dst==
and let's take this IP address, the one that starts with 18
that's the filter, or I could see only tcp packets that initialize a new connection and have the syn
flag set: tcp.flags.syn==1 These are all packets that have the syn flag set
or if you do not want to see packets of some protocols and want to negate them you use an exclamation
mark and a pair of parentheses to group the protocols.
For example !(arp or icmp or dns) it won't display packets of these protocols. And the last filter I'm
going to show you is frame contains and the word like: frame contains medium
it's displaying all packets that contains the word "medium"
You see, there is the word "medium" in each packet; this is excellent when searching for a specific
string, username or password. Wireshark is an extremely powerful tool and these lectures have just scratched
the surface of what it can do.
Network Engineers use it to troubleshoot networks, examine security problems or deeply understand how
how network protocols work. You can find more detailed information on the official website.