Network Security Wiki

Packet Captures: Difference between revisions

Page Discussion

Packet Captures (view source)

Revision as of 22:38, 12 July 2017

2,184 bytes removed ,  6 years ago
m
→‎Filtering Packets: m
Line 189:
<br />
 
=Filtering Packets=
Information related to Packet filtering is as follows:
<br />
 
==Filtering a Cap File==
dumpcap -i eth0 -f "host 208.67.220.220 and udp port 53" -w /tmp/dns.cap -b duration:3600 -b files:25
<br />
 
==Wireshark Common Filters==
{| class="wikitable"
|-
! Description !! Filter
|-
|Sets a filter for any packet with 10.0.0.1, as either the source or dest || ip.addr == 10.0.0.1
|-
|Sets a conversation filter between the two defined IP addresses || ip.addr==10.0.0.1 && ip.addr==10.0.0.2
|-
|Sets a filter to display all http and dns || http or dns
|-
|Sets a filter for any TCP packet with 4000 as a source or dest port || tcp.port==4000
|-
|Displays all TCP resets || tcp.flags.reset==1
|-
|Display all SYN packets || tcp.flags.syn==1
|-
|Filter packets using Identification Field (across multiple traces) || ip.id==518
|-
|Displays all HTTP GET requests || http.request
|-
|Displays all TCP packets that contain the word ‘traffic’.<br/>Excellent when searching on a specific string or user ID || tcp contains traffic
|-
|Masks out arp, icmp, dns, or whatever other protocols may be background noise.<br/>Allowing you to focus on the traffic of interest || !(arp or icmp or dns)
|-
|Sets a filter for the HEX values of 0x33 0x27 0x58 at any offset || udp contains 33:27:58
|-
|Displays all retransmissions in the trace.<br/>Helps when tracking down slow application performance and packet loss || tcp.analysis.retransmission
|-
|Fragmented Traffic || ip.flags.mf == 1 or ip.frag_offset > 0
|-
|ICMP Fragmentation needed packets || icmp.type==3 and icmp.code==4
|-
|Combination of above two || <nowiki>ip[0,9,20:2]==4501:0304||ip[6:2]&3fff</nowiki>
|-
|Starting and Ending sessions || tcp.flags&7 or (tcp.seq==1 and tcp.ack==1 and !tcp.window_size_scalefactor==-1 and tcp.len==0)
|}
<br />
 
== Wireshark Column Filters ==
{| class="wikitable"
|-
! Value to display !! Filter
|-
| TTL || ip.ttl
|-
| Flags || tcp.flags
|-
| SEQ || tcp.seq
|-
| ACK || tcp.ack
|-
| MSS || tcp.options.mss_val
|-
| In-Flight || tcp.analysis.bytes_in_flight
|-
| Payload || tcp.len
|-
| Window || tcp.window_size
|-
| Content-Length || http.content_length_header
|}
<br />
 
== Advanced Packet Filtering ==
Retrieved from "https://aman.awiki.org/wiki/Special:MobileDiff/1539"