


I won’t say much about what wireshark is. In short, it is a powerful packet capture tool. We often use it to capture some data packets and then analyze these data packets. Of course, most of us want to capture specific data packets and filter those unwanted data packets. Next, let’s take a look at the use of wireshark’s capture filter.
The syntax of the capture filter
The syntax of the capture filter adopts BPF syntax. If you want to know what BPF syntax is, you can do it yourself Google. To put it more simply, Wireshark's capture filter uses some qualifiers, such as (host/src/port), and qualified values, and then combines expressions through logical operators.
A simple filter is given below, which is used to specify to capture only data packets from a specific IP
host 47.***.***.16
Commonly used qualifiers are divided into the following three categories:
Type: such as host/net/port
Direction: such as src/dst
Protocol: such as ip /tcp/udp/http/https
The logical operators include the following
and operators&&
-
or operator||
Not operator!
Next, we will demonstrate how to use capture filters from several aspects.
Address filter
Address filter is the most commonly used in our daily life, used to specify data from a specific IP or host name Bag. In addition, you can also specify the MAC address and IPv6 address.
Let’s demonstrate it through several cases:
Limit IPv4 address
host 192.168.1.111
Limit address and direction: that is, limit Source address, only capture packets from a specific ip
src host 192.168.1.111
Limited MAC address
ether host 00:0c:29:84:5b:d0
Port filter
Port filters are also commonly used daily, such as only capturing data on port 80 or only capturing data packets on port 22, etc.
Capture the data packets whose destination port is port 80
src port 80
Do not capture the data packets of port 22
!port 22
Protocol filter
is used to limit the protocol. This limited protocol is not hierarchical. It can be the application layer protocol http, https, ftp, dns, or transmission. layer protocols tcp, udp or ip layer ip protocol, icmp, etc.
Only capture icmp protocol packets
icmp
Finally, let’s get a slightly more complex comprehensive example. Filters that limit IP, direction and port at the same time are as follows
host 192.168.1.111 && dst port 80
Related recommendations: "Windows Operation and Maintenance"
The above is the detailed content of Use of wireshark packet capture capture filter. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

Safe Exam Browser
Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

Dreamweaver CS6
Visual web development tools
