Differences

This shows you the differences between two versions of the page.

--- soc:tools:wireshark [2026/06/09 10:11] – titannet
+++ soc:tools:wireshark [2026/06/09 10:21] (current) – titannet
@@ Line 7: / Line 7: @@
 |''ip.src == #ip''| | |
 |''ip.dst == #ip''| | |
+|''ip.addr''| | src or dst (careful with negation!)|
 |''tcp.srcport == #port''| | |
 |''tcp.dstport == #port''| | |
@@ Line 13: / Line 14: @@
 |''''| | |
 |''''| | |
+|''eth.addr[0:3]==00:06:5B''| | Filter for manufacturer (example: Dell) |
+|''''| | |
+|''''| | |
+|''''| | |
+|''''| | |
+|''''| | |
 ==== DNS ====
@@ Line 21: / Line 30: @@
 frame contains ""
 frame.length > 1500
+fame.time >= ""
 ssl.handshake.extensions_server_name == ""
@@ Line 50: / Line 60: @@
 |''tcp.len > 1000''| | Large packets |
 |''''| | |
+|''tcp.window_size == 0 && tcp.flags.reset != 1''| | TCP Buffer full |
+|''''| | |
+|''''| | |
+|''''| | |
@@ Line 56: / Line 72: @@
 |''http.request.method == "GET"''| | http get |
+|''http.host = ""''| | |
+|''http.request.uri matches "last$"''| | |
+|''''| | |
+==== Windows ====
+|''smb || nbns || dcerpc || nbss || dns''| | Client/AD traffic |
+|''''| | |
+|''''| | |
+|''''| | |
+|''''| | |
+|''''| | |
+|''''| | |
 |''''| | |
 |''''| | |
@@ Line 72: / Line 102: @@
 |''ip''| only IP traffic |
 |''not broadcast and not multicast''| | |
-|''''| | |
+|''vlan''| | |
 |''''| | |
 |''''| | |