Packet Captures: Difference between revisions

{| class="wikitable"

|-

! Description !! Filter

|-

|Sets a filter for any packet with 10.0.0.1, as either the source or dest || ip.addr == 10.0.0.1

|-

|Sets a conversation filter between the two defined IP addresses || ip.addr==10.0.0.1 && ip.addr==10.0.0.2

|-

|Sets a filter to display all http and dns || http or dns

|-

|Sets a filter for any TCP packet with 4000 as a source or dest port || tcp.port==4000

|-

|Displays all TCP resets || tcp.flags.reset==1

|-

|Displays all HTTP GET requests || http.request

|-

|Displays all TCP packets that contain the word ‘traffic’.<br/>Excellent when searching on a specific string or user ID || tcp contains traffic

|-

|Masks out arp, icmp, dns, or whatever other protocols may be background noise.<br/>Allowing you to focus on the traffic of interest || !(arp or icmp or dns)

|-

|Sets a filter for the HEX values of 0x33 0x27 0x58 at any offset || udp contains 33:27:58

|-

|Displays all retransmissions in the trace.<br/>Helps when tracking down slow application performance and packet loss || tcp.analysis.retransmission

|-

|Fragmented Traffic || ip.flags.mf == 1 or ip.frag_offset > 0

|-

|ICMP Fragmentation needed packets || icmp.type==3 and icmp.code==4

|-

|Combination of above two || ip[0,9,20:2]==4501:0304||ip[6:2]&3fff

|-

|Starting and Ending sessions || tcp.flags&7 or (tcp.seq==1 and tcp.ack==1 and !tcp.window_size_scalefactor==-1 and tcp.len==0)

|}