Mastering Wireshark: Filtering by Protocol Like a Pro

So, you want to filter Wireshark by protocol? The answer, in its simplest form, is to use the display filter toolbar at the top of the Wireshark window and enter the protocol you want to see. For example, typing http and pressing enter will display only HTTP traffic. This is the tip of the iceberg, however. Becoming proficient requires understanding various nuances and advanced techniques. Read on, and you’ll discover how to wield protocol filters like a seasoned network analyst.

Diving Deeper: The Art of Protocol Filtering

Filtering by protocol is the bread and butter of any Wireshark analysis. It allows you to isolate specific types of traffic, making it easier to diagnose problems, analyze security vulnerabilities, or simply understand network behavior. Beyond the simple protocol name, you can combine protocols with operators and fields for incredibly granular filtering.

Basic Protocol Filtering

The most straightforward method involves typing the protocol name directly into the display filter bar. Wireshark understands a vast array of protocols, from common ones like TCP and UDP to more specialized ones like SMB and DNS.

• HTTP: Shows all HTTP traffic.
• TCP: Displays all TCP segments.
• UDP: Captures UDP datagrams.
• DNS: Filters for DNS queries and responses.
• SSH: Highlights SSH traffic.

Case sensitivity isn’t typically an issue, but it’s a good habit to use lowercase for protocol names.

Combining Protocols with Operators

The real power of Wireshark filters lies in the ability to combine protocols with operators. This allows you to create more specific and targeted views.

• && (and): Combines two conditions; both must be true. For example, http && ip.addr == 192.168.1.100 shows HTTP traffic involving the IP address 192.168.1.100.
• 
  

  	(or): Displays traffic matching either condition. tcp

• ! (not): Excludes traffic matching a condition. !http shows all traffic except HTTP.
• == (equals): Checks for equality. tcp.port == 80 shows TCP traffic on port 80.
• != (not equals): Checks for inequality. ip.src != 192.168.1.1 shows traffic where the source IP address is not 192.168.1.1.
• > (greater than): tcp.len > 1000 shows TCP segments larger than 1000 bytes.
• < (less than): udp.length < 50 shows UDP packets smaller than 50 bytes.
• >= (greater than or equals):
• <= (less than or equals):
• contains: Checks if a field contains a specific string. http.request.uri contains "password" shows HTTP requests with "password" in the URI.

Filtering by Protocol Fields

Every protocol has specific fields that you can filter on. These fields provide incredibly granular control over what you see. You can find these fields by examining the packet details in the Wireshark window. Expanding a protocol in the packet dissection pane reveals its fields.

For example, to filter based on the HTTP request method: http.request.method == "GET" or http.request.method == "POST".

Similarly, you can filter based on TCP ports: tcp.srcport == 21 (FTP source port) or tcp.dstport == 443 (HTTPS destination port).

Understanding these protocol-specific fields is crucial for advanced analysis.

Using Filter Expressions

Wireshark allows you to save complex filters as filter expressions. This saves time and ensures consistency. To save a filter, type it into the display filter bar, click the small "Save" button (it looks like a bookmark), give it a name, and optionally a comment. You can then quickly recall the filter expression later.

Frequently Asked Questions (FAQs)

Here are some common questions and answers to further solidify your understanding of protocol filtering in Wireshark.

1. How do I filter for traffic between two specific IP addresses using a particular protocol?

Use the ip.addr field combined with the protocol name and the && operator. For example: tcp && ip.addr == 192.168.1.100 && ip.addr == 10.0.0.5. This will show only TCP traffic between those two IP addresses.

2. Can I filter for a range of port numbers?

Yes, you can use the tcp.port >= lower_limit && tcp.port <= upper_limit or udp.port >= lower_limit && udp.port <= upper_limit syntax. For example, to filter for TCP ports between 8000 and 8080: tcp.port >= 8000 && tcp.port <= 8080.

3. How can I exclude a specific protocol from my view?

Use the ! (not) operator. For example, !dns will hide all DNS traffic. You can also exclude multiple protocols: !(http

4. How do I filter for fragmented IP packets?

Use the ip.flags.mf == 1 filter. This will show IP packets with the "More Fragments" flag set, indicating that they are part of a fragmented datagram.

5. How do I find HTTP traffic with a specific user agent?

Use the http.user_agent contains "string" filter. Replace "string" with the user agent you are looking for. For example: http.user_agent contains "Mozilla/5.0".

6. Is it possible to filter based on the size of a packet?

Yes, you can use the frame.len field (total frame length) or protocol-specific length fields. For example, frame.len > 1500 shows packets larger than 1500 bytes. tcp.len > 1000 shows TCP data segments larger than 1000 bytes (excluding headers).

7. How can I filter for packets with a specific TCP flag set (e.g., SYN)?

Use the tcp.flags field. Common flags include SYN, ACK, FIN, RST, and PSH. For example, to filter for SYN packets: tcp.flags.syn == 1. To filter for SYN-ACK packets: tcp.flags.syn == 1 && tcp.flags.ack == 1.

8. What's the difference between tcp.stream and other TCP filters?

tcp.stream allows you to filter based on the TCP conversation flow identified by Wireshark. Each unique TCP connection is assigned a stream index. Filtering by tcp.stream eq 0 will show the first TCP stream identified in the capture. This is useful for following a complete TCP conversation. Other TCP filters, like tcp.port, filter individual packets based on their specific characteristics, not the overall flow.

9. How do I filter for packets with a specific IPv6 address?

Use the ipv6.addr field. For example: ipv6.addr == 2001:db8::1. You can also filter by source or destination address: ipv6.src == 2001:db8::1 or ipv6.dst == 2001:db8::1.

10. I applied a filter, but I don't see any packets. What's wrong?

Double-check your filter syntax for typos. Also, ensure that the capture file actually contains the traffic you are filtering for. You can test this by removing the filter and observing all traffic first. Sometimes, capitalization matters in specific fields or the protocol you are trying to filter does not exist on your trace.

11. Can I use regular expressions in Wireshark filters?

Yes, you can use regular expressions with the matches operator. For example, to find HTTP requests with a URI containing "login" or "signin": http.request.uri matches "login|signin". This requires understanding regular expression syntax.

12. How do I clear the display filter in Wireshark?

Simply click the "Clear" button (the "X" icon) in the display filter toolbar, or delete the text in the filter bar and press Enter. This will remove the filter and display all captured traffic.

Conclusion

Mastering Wireshark protocol filtering is essential for effective network analysis. By understanding the various operators, protocol fields, and filter expressions, you can quickly isolate and analyze the traffic you need. Practice with these techniques, and you'll be well on your way to becoming a Wireshark wizard. Remember to experiment with different filters and consult the Wireshark documentation for a complete list of protocols and fields. Happy analyzing!