meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
soc:tools:wireshark [2026/06/09 09:49] – created titannetsoc:tools:wireshark [2026/06/09 10:21] (current) – titannet
Line 1: Line 1:
 ====== Wireshark ====== ====== Wireshark ======
  
-===== Filters =====+===== Display Filters ===== 
 + 
 +==== Network ==== 
 + 
 +|''ip.src == #ip''| | | 
 +|''ip.dst == #ip''| | | 
 +|''ip.addr''| | src or dst (careful with negation!)| 
 +|''tcp.srcport == #port''| | | 
 +|''tcp.dstport == #port''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 + 
 +|''eth.addr[0:3]==00:06:5B''| | Filter for manufacturer (example: Dell) | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 + 
 + 
 +==== DNS ==== 
 +dns.qry.name == "" 
 + 
 + 
 +==== Content ==== 
 +frame contains "" 
 +frame.length > 1500 
 +fame.time >= "" 
 +ssl.handshake.extensions_server_name == "" 
 + 
 +==== Protocols ==== 
 + 
 +|''tcp''| | | 
 +|''udp''| | | 
 +|''icmp''| | | 
 +|''http''| | | 
 +|''tls''| | | 
 +|''dns''| | | 
 +|''arp''| | | 
 +|''ftp''| | | 
 +|''smtp''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 + 
 + 
 +==== TCP ==== 
 + 
 +|''tcp.flags.syn == 1 && tcp.flags.ack == 0''| | Syn scan | 
 +|''tcp.flags.reset == 1''| | Reset | 
 +|''tcp.flags.fin == 1''| | Fin | 
 +|''tcp.flags.urg == 1''| | Urgent | 
 +|''tcp.analysis.retransmission''| | | 
 +|''tcp.analysis.flags''| | | 
 +|''tcp.len > 1000''| | Large packets | 
 +|''''| | | 
 + 
 +|''tcp.window_size == 0 && tcp.flags.reset != 1''| | TCP Buffer full | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 + 
 + 
 + 
 + 
 +==== http ==== 
 + 
 +|''http.request.method == "GET"''| | http get | 
 +|''http.host = ""''| | | 
 +|''http.request.uri matches "last$"''| | | 
 +|''''| | | 
 + 
 +==== Windows ==== 
 + 
 + 
 +|''smb || nbns || dcerpc || nbss || dns''| | Client/AD traffic | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 +|''''| | | 
 + 
 +===== Capture Filters =====
  
 ==== Network ==== ==== Network ====
Line 10: Line 99:
 |''src net #ip/net''| | | |''src net #ip/net''| | |
 |''dst net #ip/net''| | | |''dst net #ip/net''| | |
-|''post #port''| | | +|''post #port''|''tcp.port < #high''| | 
-|''tcp portrange #low-#high''|''(tcp[0:2] > #low and tcp[0:2] < #high) or (tcp[2:2] > #low and tcp[2:2] < #high)''| |+|''ip''| only IP traffic | 
 +|''not broadcast and not multicast''| | | 
 +|''vlan''| | |
 |''''| | | |''''| | |
 |''''| | | |''''| | |
 +
 +
 +==== http ====
 +
 +|''port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420''| | http get |
 |''''| | | |''''| | |
 |''''| | | |''''| | |
 +|''''| | |
 +|''''| | |
 +|''''| | |
 +
 +
 +
 +==== Ipv6  ====
 +
 +^^^^
 +|''dst host ff02::1''| | "All nodes" traffic |
 +|''''| | |
 +|''''| | |
 +|''''| | |
 +|''''| | |
 +|''''| | |
 +
 +
 +
 +
 +==== Bin ====
 +
 +<code bash>
 +tcp portrange #low-#high''|''(tcp[0:2] > #low and tcp[0:2] < #high) or (tcp[2:2] > #low and tcp[2:2] < #high)
 +</code>
 +