Top 10 Wireshark Filters // Filtering with Wireshark on the packets that matter

in this video we're gonna take a look at the top 10 Wireshark filters that I like to use for setting display filters so probably the reason you're here is because from time to time we might need to set a filter and we don't quite know what the syntax is for it so here are some common ones that I like to use and no doubt they will be of use to you as well so the first one that I like to use and this is a very common one perhaps the first one that I set in any trace file and that's just a station filter or an IP filter and that's what I want to show any packets to or from a certain IP address so what I do is I come up to the address bar the filter bar and I type in IP addr now what that does is that gives me either this IP address and I'm gonna specify as a source or as a destination IP if I wanted to be more specific and only have that IP as either the source or the destination that's where I would make a change here I could either type in IP SRC to be the source or IP DST to be just the IP destination now you'll notice in the background any time that you get a syntax right then you'll see that the background turns green that means that you you got it correct you got the right syntax for what you're looking for now if you type something wrong like address for example that's gonna be red that tells us that Wireshark does not recognize that as an appropriate display filter syntax so I'm gonna back up there so back to my original filter IP a derp equals equals and then the IP address that I want to filter on what that does is it will filter out any packet that does not match this filter as either the source or the destination IP and it will only show me conversations to and from that station now the next thing that we may want to do is to set a filter for a protocol now that's pretty simple as well if we come up to our filter bar I'm just going to clear this conversation filter that we sent and that's when we can type in whatever the protocol may be it could be ARP it could be TCP could be DNS could be HTTP whatever the case may be that's a pretty simple one to fill to filter for and remember that your green bar will always turn green when you've hit the nail on the head now it could be want to protocols to be displayed for example you want to display both DNS and HTTP now what we do is we come up to the top and we would type in DNS that would be our first application now the mistake that's easy to make as we can type in DNS and HTTP what this does is it requires a packet to be both DNS protocol and HTTP protocol at the same time which is impossible so we don't want to use the and switch there instead we want to go in and say DNS or HTTP what that does is it will display only the DNS traffic and HTTP traffic that we have in this trace file the next filter that we may want to set is a common one as well and that's for a TCP or a UDP port number so if I come up to the top I can clear out what I was working with before and I can type in TCP dot port what that does is it sets a filter for a specific port number that I then specify now of course if I want this to be UDP I could put UDP port now since I don't have a port source or port destination specification in this filter it will show me all packets with that port as either the source port or the destination port and this is a good filter to keep in mind if we're looking for a real specific port number that might not have a protocol associated with it or maybe even a ephemeral port on the client side now the next filter that we're going to look at is one that's good to use we're digging for packet loss or retransmissions on the network and this is a filter that will show us any TCP problems in this trace file so again if I come up and I clear the previous trace file out I can come up to my filter bar and I can type in TCP analysis dot flags now Wireshark can flag TCP problems in the trace file wherever they may occur and what this filter does is it only shows me those flags it shows me the problems that Wireshark has identified in the trace file so you can see for example here we have some duplicate acknowledgments his mission a TCP previous segment not captured now all of those may indicate packet loss could be window problems or whatever those TCP issues are that Wireshark has already flagged this is an excellent filter to use if we're just trying to quickly identify whether a problem is rooted in the network or if it's rooted in the application the next filter we're going to take a look at is how we can remove some of the noise and when we're looking in a trace file it's already hard enough to look through these lines of code and dig in and try to make sense of what's really happening with also having spurious protocols or applications running that aren't really helpful to what we're doing so what I'm going to do is go up to the Clear button again and let's go up to our filter bar and we want to create a list of protocols or applications that were not interested in looking at so to do that to remove them from the trace file or to filter them out we would first use our knot symbol then we would do parentheses now this is if I want a list of things so a common one that I'll do is I'll say ARP or DNS or ICMP just for example what this will do is it will remove ARP DNS and ICMP from the trace file and only leave whatever is left this is what we call pruning the trace file it's cleaning up these extra things that may not be helpful to what we're really digging in and trying to find the next very common display filter that we're gonna look at is how we can follow a tcp stream now what we mean by that is when we just want to focus on one single TCP connection now we could do this manually up in the filter bar we could type in the source tcp port the destination tcp port and set that as a conversation and that can get a little complicated but to do it quickly with Wireshark I'm just going to come up to the my clear button again I can select any packet in a TCP conversation that I'm interested in looking at right click it and then go down to follow TCP stream now initially this will bring up the follow TCP stream content if there is any content in the TCP packets in that stream there's going to close this what I will see here is any packets that are related to that TCP conversation so notice my ephemeral client port my server port my since in a CAC and I see a spurious retransmission these were the only five packets involved for this trace file in that one TCP connection now alternatively I could have got up to the TCP stream equals thirty-two filter but most of the time that's not how we set these instead we just look at a packet that's involved in the connection we want to filter on right-click it and set that TCP stream now sometimes we may want to set a filter not for a port or for an IP conversation but for text word maybe we're digging for a certain username or we want to see if there's a certain tab name and an application that's sent in the packets so to do that it's a simple filter we can come up to clear and this time we're going to use what's called the TCP contains filter now here I can type in any clear text word that I want to and anywhere where that word may appear in any packet in this entire trace file will be displayed so for example I can do TCP contains Facebook if I'm interested in seeing which devices are out there talking to Facebook now once I set that filter if I come down into the clear text view within Wireshark I'm just scroll over because on mine it's a little hidden this is where I can see where that actual word appears I see facebook.com now remember that up here I set a filter for any TCP packet that contains the word Facebook but just as easily I could wipe this and I could type in UDP contains Facebook and that would show me all of my DNS queries to Facebook or that have that word Facebook in the packets so again this is a very useful filter if we're looking for things like Facebook or a username or perhaps a torrent user and again that's the TCP or UDP contains and in the string now from here we're going to take a look at a couple very useful application filters built into Wireshark now specifically these involve HTTP now HTTP as we know it's an application that uses requests and responses from users so I'm gonna come up and clear my previous filter out and I come over to my filter bar and I'm going to type in HTTP dot request what that will do is it will display all HTTP requests involve in this trace file I can see all the gets I can see all the servers involved of the clients involved if there's any retransmissions as we see here I'm just gonna bring my hex view a little bit out of the way there now it's also possible that I want to filter for a specific response code so I could go up to the bar up here and I can back out requests and I can type in response come down to code equals equals and then I could type in 200 for the ok responses or four oh four or 500 if I suspect I have a server err whatever the case may be and that will filter only for the HTTP responses so those are also some useful filters when I'm doing HTTP analysis now we're just gonna look at two more display filters in this video and one of those is more related to security so I want to set a filter to see if one of my servers is getting syn attacked I wanna see how many syn connections are coming in to a system where they're coming from and what those ports look like so let's do that I'm gonna clear my filter and I'm gonna come up to my filter bar and I type in TCP dot Flags dot s Y and what I want to do is I want to be sure that all packets with the syn bit in the TCP header set to one are displayed so this means show me all sins and what I'm gonna look for in my patterns over here in the information I want to look for rapidly incrementing syn connections coming from one station or two stations or whatever the case may be into a server and that will indicate is that servers being attacked so there will just be a single destination and these will be coming in very quick and likely there will be thousands and thousands and thousands of them now it's also possible I could use this flags filter to look for things like TCP resets and to do that all I got to do is remove this in and type in reset and that will show me all TCP resets that are in the trace file now the final Wireshark display filter that will show in this video today has to do a voice over IP now but since I don't have any voice in this trace file I'll just show you what the filter looks like if I come up and I clear this one now with VoIP it has both a signaling protocol and also an RTP stream so if I just type in sip that means that I'll just get the signaling between a phone and the call manager or that call manager in the remote phone if I type in just RTP then I'm only gonna get the RTP stream between those two phones but to say both I can type in sip ampersand ampersand RTP in order to get both of those together both the control and the RTP feed now I hope this top 10 Wireshark filters video was helpful for you if you have any other questions please feel free to comment in the line below or if you have other Wireshark filters that you like to use that you'd like to share also please add those as well thank you for watching this video bye packet pioneer if you're experiencing network or application performance problems and you need help resolving them please get in touch with us at WWE TA or calm or by sending us an email at packet pioneer at gmail.com

Channel: Chris Greer

Views: 495,909

Rating: 4.9508033 out of 5

Keywords: Wireshark (Software), tcp, filter, filters, display, ip, wireshark filters, facebook users, wireshark tutorial 2020, wireshark tutorial, wireshark course, wireshark tips, tcp filters, tcp/ip, how to use wireshark, network troubleshooting, packet analysis, packet filtering, free wireshark training, free wireshark tutorial, filtering with wireshark

Id: 68t07-KOH9Y

Length: 12min 12sec (732 seconds)

Published: Thu Nov 20 2014