Wireshark/Filter: Unterschied zwischen den Versionen
| Zeile 38: | Zeile 38: | ||
=== Beispiele === | === Beispiele === | ||
{| | |||
|- | |||
| ip.addr == 10.0.0.1 || all traffic with 10.0.0.1 as either source or destination | |||
|- | |||
| ip.addr == 10.0.0.0/24 || all traffic to and from any address in 10.0.0.0/24 | |||
|- | |||
| ip.src == 10.0.0.1 && ip.dst == 10.0.0.2 || all traffic from 10.0.0.1 to 10.0.0.2 | |||
|- | |||
| !(ip.addr == 10.0.0.1) || Exclude all traffic to or from 10.0.0.1 | |||
|- | |||
| icmp.type == 3 || ICMP "destination unreachable" packets | |||
|- | |||
| tcp or udp || TCP or UDP traffic | |||
|- | |||
| tcp.port ==80 || TCP traffic with port 80 | |||
|- | |||
| tcp.srcport < 1000 || TCP traffic with src port range | |||
|- | |||
| http or dns || all HTTP or DNS traffic on Instagram | |||
|- | |||
| tcp.flags.syn == 1 || TCP packets with SYN flag set | |||
|- | |||
| tcp.flags == 0x012 || TCP packets with both SYN and ACK flags set | |||
|- | |||
| tcp.analysis.retransmission || all retransmitted TCP packets | |||
|- | |||
| http.request.method =="GET" || TCP packets associated with HTTP GET | |||
|- | |||
| http.response.code == 404 || packets associated with HTTP 404 response | |||
|- | |||
| http.host == "www.test.com" || HTTP traffic matching the Host header field | |||
|- | |||
| tls.handshake || only TLS handshake packets | |||
|- | |||
| tls.handshake.type ==1 || client Hello packet during TLS handshake | |||
|- | |||
| dhcp and ip.addr == 10.0.0.0/24 || DHCP traffic for 10.0.0.0/24 subnet | |||
|- | |||
| dhcep.hw.mac_addr == 00:11:22:33:44:55 || DHCP packets for client MAC addr | |||
|- | |||
| dns.resp.name == cnn.com || DNS responses with name field of "cnn.com" | |||
|- | |||
| frame contains keyword || all packets that contain the word "keyword" | |||
|- | |||
| frame.len > 1000 || all packets with total length larger than 1000 bytes | |||
|- | |||
| eth.addr == 00:11:22:33:44:55 || all traffic to or from the specified MAC addr | |||
|- | |||
| eth[0x47:2] == 01:80 || Match Ethernet frames with 2 bytes at offset 0x47 == 01:80 | |||
|- | |||
| !(arp or icmp or stp) || Filter out background traffic from ARP, ICMP and STP | |||
|- | |||
| vlan.id == 100 || packets with VLAN ID 100 | |||
|} | |||
[[File:2024-09-25_11-00-00_UTC.jpg|400px|https://www.instagram.com/p/DAVnESFSqec/]] | [[File:2024-09-25_11-00-00_UTC.jpg|400px|https://www.instagram.com/p/DAVnESFSqec/]] | ||
<br clear=all> | <br clear=all> | ||
Version vom 17. Mai 2026, 18:53 Uhr
Wireshark/Filter
Beschreibung
Display-Filter
Netzwerkverkehr aufzeichnen, filtern und auswerten
- Zeigt nur STMP (Port 25) und ICMP-Traffic
- Schaltfläche ...mit diesem Filter: wird der Filter eingegeben, mit dem gesucht werden soll
- Anschließend die gewünschte (aktive) Verbindung auswählen
- Die Aufzeichnung der Datenübertragung starten
- Die Aufzeichnung läuft und Wireshark zeigt in einem Statusfenster die Anzahl der aufgezeichneten Frames (Captured Packets) an
Datenübertragung stoppen
Das wichtigste Instrument zum Auswerten von Traces sind Filter
- Mit Filtern wird die Anzeige auf die interessanten Frames eingeschränkt
- Um nur noch Traffic von und zu unserer eigenen IP-Adresse zu sehen, geben wir im Eingabefeld Filter von Wireshark folgenden Ausdruck ein:
ip.addr == 192.168.1.2
- Als IP-Adresse setzen wir die IP-Adresse des Sniffers ein, also unsere eigene
- Wireshark zeigt nun nur noch Frames an, die diese Filterbedingung erfüllen
- Mit der Schaltfläche Clear kann die Filterbedingung gelöscht werden
Filter erweitern
Anzeige weiter einschränken
- Nur der Traffic des Ping-Kommandos ist interessant. Ping nutzt ein Protokoll namens ICMP
Filterbedingung entsprechend erweitern:
ip.addr == 192.168.1.2 && icmp
Mit dem Operator && werden die einzelnen Filterbedingungen UND-verknüpft
- icmp schränkt die Anzeige auf das Protokoll ICMP ein
- In der Anzeige sind jetzt nur noch ICMP-Pakete unserer eigenen IP-Adresse zu sehen
Beispiele
| ip.addr == 10.0.0.1 | all traffic with 10.0.0.1 as either source or destination |
| ip.addr == 10.0.0.0/24 | all traffic to and from any address in 10.0.0.0/24 |
| ip.src == 10.0.0.1 && ip.dst == 10.0.0.2 | all traffic from 10.0.0.1 to 10.0.0.2 |
| !(ip.addr == 10.0.0.1) | Exclude all traffic to or from 10.0.0.1 |
| icmp.type == 3 | ICMP "destination unreachable" packets |
| tcp or udp | TCP or UDP traffic |
| tcp.port ==80 | TCP traffic with port 80 |
| tcp.srcport < 1000 | TCP traffic with src port range |
| http or dns | all HTTP or DNS traffic on Instagram |
| tcp.flags.syn == 1 | TCP packets with SYN flag set |
| tcp.flags == 0x012 | TCP packets with both SYN and ACK flags set |
| tcp.analysis.retransmission | all retransmitted TCP packets |
| http.request.method =="GET" | TCP packets associated with HTTP GET |
| http.response.code == 404 | packets associated with HTTP 404 response |
| http.host == "www.test.com" | HTTP traffic matching the Host header field |
| tls.handshake | only TLS handshake packets |
| tls.handshake.type ==1 | client Hello packet during TLS handshake |
| dhcp and ip.addr == 10.0.0.0/24 | DHCP traffic for 10.0.0.0/24 subnet |
| dhcep.hw.mac_addr == 00:11:22:33:44:55 | DHCP packets for client MAC addr |
| dns.resp.name == cnn.com | DNS responses with name field of "cnn.com" |
| frame contains keyword | all packets that contain the word "keyword" |
| frame.len > 1000 | all packets with total length larger than 1000 bytes |
| eth.addr == 00:11:22:33:44:55 | all traffic to or from the specified MAC addr |
| eth[0x47:2] == 01:80 | Match Ethernet frames with 2 bytes at offset 0x47 == 01:80 |
| !(arp or icmp or stp) | Filter out background traffic from ARP, ICMP and STP |
| vlan.id == 100 | packets with VLAN ID 100 |
https://www.instagram.com/p/DAVnESFSqec/
Anhang
Siehe auch
Dokumentation
- Man-Page