Use of wireshark packet capture capture filter

I won’t say much about what wireshark is. In short, it is a powerful packet capture tool. We often use it to capture some data packets and then analyze these data packets. Of course, most of us want to capture specific data packets and filter those unwanted data packets. Next, let’s take a look at the use of wireshark’s capture filter.

The syntax of the capture filter

The syntax of the capture filter adopts BPF syntax. If you want to know what BPF syntax is, you can do it yourself Google. To put it more simply, Wireshark's capture filter uses some qualifiers, such as (host/src/port), and qualified values, and then combines expressions through logical operators.

A simple filter is given below, which is used to specify to capture only data packets from a specific IP

host 47.***.***.16

Commonly used qualifiers are divided into the following three categories:

• Type: such as host/net/port

• Direction: such as src/dst

• Protocol: such as ip /tcp/udp/http/https

The logical operators include the following

• and operators&&

• or operator||

• Not operator!

Next, we will demonstrate how to use capture filters from several aspects.

Address filter

Address filter is the most commonly used in our daily life, used to specify data from a specific IP or host name Bag. In addition, you can also specify the MAC address and IPv6 address.

Let’s demonstrate it through several cases:

Limit IPv4 address

host 192.168.1.111

Limit address and direction: that is, limit Source address, only capture packets from a specific ip

src host 192.168.1.111

Limited MAC address

ether host 00:0c:29:84:5b:d0

Port filter

Port filters are also commonly used daily, such as only capturing data on port 80 or only capturing data packets on port 22, etc.

Capture the data packets whose destination port is port 80

src port 80

Do not capture the data packets of port 22

!port 22

Protocol filter

is used to limit the protocol. This limited protocol is not hierarchical. It can be the application layer protocol http, https, ftp, dns, or transmission. layer protocols tcp, udp or ip layer ip protocol, icmp, etc.

Only capture icmp protocol packets

icmp

Finally, let’s get a slightly more complex comprehensive example. Filters that limit IP, direction and port at the same time are as follows

host 192.168.1.111 && dst port 80

Related recommendations: "Windows Operation and Maintenance"

The above is the detailed content of Use of wireshark packet capture capture filter. For more information, please follow other related articles on the PHP Chinese website!