Wireshark Display Filter Examples (Filter by Port, IP, Protocol)

WireShark:

While debugging a particular problem, sometimes you may have to analyze the protocol traffic going out and coming into your machine. 

Wireshark is one of the best tool used for this purpose. In this article we will learn how to use Wireshark network protocol analyzer display filter.

Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library. 

If you need a capture filter for a specific protocol, have a look for it at the ProtocolReference 

1. Download and Install Wireshark

Download wireshark from here.
After downloading the executable, just click on it to install Wireshark.

#yum  -y install wireshark* 

#wireshark ----------------->open GUI Popup menu like below

 

2. Select an Interface and Start the Capture

Once you have opened the wireshark, you have to first select a particular network interface of your machine. In most of the cases the machine is connected to only one network interface but in case there are multiple, then select the interface on which you want to monitor the traffic.
From the menu, click on ‘Capture –> Interfaces’, which will display the following screen:

3. Source IP Filter

A source filter can be applied to restrict the packet view in wireshark to only those packets that have source IP as mentioned in the filter. The filter applied in the example below is:

ip.src == 192.168.1.1

4. Destination IP Filter

A destination filter can be applied to restrict the packet view in wireshark to only those packets that have destination IP as mentioned in the filter. For example:

ip.dst == 192.168.1.1

5. Filter by Protocol

Its very easy to apply filter for a particular protocol. Just write the name of that protocol in the filter tab and hit enter. In the example below we tried to filter the results for http protocol using this filter:

http

6. Using OR Condition in Filter

This filter helps filtering the packets that match either one or the other condition.
Suppose, there may arise a requirement to see packets that either have protocol ‘http’ or ‘arp’. In that case one cannot apply separate filters. So there exists the ‘||’ filter expression that ORs two conditions to display packets matching any or both the conditions. In the example below, we tried to filter the http or arp packets using this filter:

http||arp

7. Applying AND Condition in Filter

This filter helps filtering packet that match exactly with multiple conditions.
Suppose there is a requirement to filter only those packets that are HTTP packets and have source ip as ’192.168.1.4′. Use this filter:

http&&ip.src==192.168.1.4

8. Filter by Port Number

This can be done by using the filter ‘tcp.port eq [port-no]‘. For example:

tcp.port eq 80

9. Match Packets Containing a Particular Sequence

The filter syntax used in this is : ‘[prot] contains [byte sequence]‘.
For example:

tcp contains 01:01:04

10. Reject Packets Based on Source or Destination

Filter here is ‘ip.src != [src_addr]‘ or ‘ip.dst != [dst_add]‘.
For example:

ip.dst != 192.168.1.1

****************************************************************************

Default Capture Filters

Wireshark tries to determine if it's running remotely (e.g. via SSH or Remote Desktop), and if so sets a default capture filter that should block out the remote session traffic. It does this by checking environment variables in the following order: 

Environment Variable	Resultant Filter
SSH_CONNECTION	not (tcp port srcport and addr_family host srchost and tcp port dstport and addr_family host dsthost)
SSH_CLIENT	not (tcp port srcport and addr_family host srchost and tcp port dstport)
REMOTEHOST	not addr_family host host
DISPLAY	not addr_family host host
CLIENTNAME	not tcp port 3389

**************************************************************************** 

More Examples: Click Me