in this video we're gonna take a look at the top 10 Wireshark filters that I like to use for
setting display filters. So probably the reason you're here is because from time to time we might
need to set a filter and we don't quite know what the syntax is for it. So here are some common ones
that I like to use and no doubt they will be of use to you as well. So the first one that I like
to use and this is a very common one perhaps the first one that I set in any trace file and
that's just a station filter or an IP filter. and that's when I want to show any packets to
or from a certain IP address. So what I do is I come up to the address bar the filter bar and I
type in IP.addr Now what that does is that gives me either this IP address and I'm gonna specify as
a source or as a destination IP if I wanted to be more specific and only have that IP as either the
source or the destination. That's where I would make a change here I could either type in IP
SRC to be the source or IP DST to be just the IP destination. Now you'll notice in the background
any time that you get a syntax right then you'll see that the background turns green. That means
that you you got it correct you got the right syntax for what you're looking for. Now if you
type something wrong, like address for example, that's gonna be red. That tells us that Wireshark
does not recognize that as an appropriate display filter syntax. So I'm gonna back up there,
so back to my original filter IP.addr equals equals and then the IP address that I want
to filter on. What that does is it will filter out any packet that does not match this filter
as either the source or the destination IP and it will only show me conversations to and from
that station. Now the next thing that we may want to do is to set a filter for a protocol
now that's pretty simple as well if we come up to our filter bar I'm just going to clear this
conversation filter that we sent and that's when we can type in whatever the protocol may be it
could be ARP it could be TCP could be DNS could be HTTP whatever the case may be that's a pretty
simple one to fill to filter for and remember that your green bar will always turn green when
you've hit the nail on the head now it could be want to protocols to be displayed for example you
want to display both DNS and HTTP now what we do is we come up to the top and we would type
in DNS that would be our first application now the mistake that's easy to make as we can type in DNS
and HTTP what this does is it requires a packet to be both DNS protocol and HTTP protocol at the same
time which is impossible so we don't want to use the and switch there instead we want to go in and
say DNS or HTTP what that does is it will display only the DNS traffic and HTTP traffic that we have
in this trace file the next filter that we may want to set is a common one as well and that's for
a TCP or a UDP port number so if I come up to the top I can clear out what I was working with before
and I can type in TCP dot port what that does is it sets a filter for a specific port number that
I then specify now of course if I want this to be UDP I could put UDP port now since I don't have a
port source or port destination specification in this filter it will show me all packets with that
port as either the source port or the destination port and this is a good filter to keep in mind if
we're looking for a real specific port number that might not have a protocol associated with it or
maybe even a ephemeral port on the client side now the next filter that we're going to look at is one
that's good to use we're digging for packet loss or retransmissions on the network and this is a
filter that will show us any TCP problems in this trace file so again if I come up and I clear the
previous trace file out I can come up to my filter bar and I can type in TCP analysis dot flags now
Wireshark can flag TCP problems in the trace file wherever they may occur and what this filter does
is it only shows me those flags it shows me the problems that Wireshark has identified in the
trace file so you can see for example here we have some duplicate acknowledgments his mission a TCP
previous segment not captured now all of those may indicate packet loss could be window problems or
whatever those TCP issues are that Wireshark has already flagged this is an excellent filter to use
if we're just trying to quickly identify whether a problem is rooted in the network or if it's rooted
in the application the next filter we're going to take a look at is how we can remove some of
the noise and when we're looking in a trace file it's already hard enough to look through these
lines of code and dig in and try to make sense of what's really happening with also having spurious
protocols or applications running that aren't really helpful to what we're doing so what I'm
going to do is go up to the Clear button again and let's go up to our filter bar and we want
to create a list of protocols or applications that were not interested in looking at so to do that to
remove them from the trace file or to filter them out we would first use our knot symbol then we
would do parentheses now this is if I want a list of things so a common one that I'll do is I'll say
ARP or DNS or ICMP just for example what this will do is it will remove ARP DNS and ICMP from the
trace file and only leave whatever is left this is what we call pruning the trace file it's cleaning
up these extra things that may not be helpful to what we're really digging in and trying to
find the next very common display filter that we're gonna look at is how we can follow a tcp
stream now what we mean by that is when we just want to focus on one single TCP connection now
we could do this manually up in the filter bar we could type in the source tcp port the destination
tcp port and set that as a conversation and that can get a little complicated but to do it quickly
with Wireshark I'm just going to come up to the my clear button again I can select any packet in
a TCP conversation that I'm interested in looking at right click it and then go down to follow TCP
stream now initially this will bring up the follow TCP stream content if there is any content in the
TCP packets in that stream there's going to close this what I will see here is any packets that are
related to that TCP conversation so notice my ephemeral client port my server port my since
in a CAC and I see a spurious retransmission these were the only five packets involved for
this trace file in that one TCP connection now alternatively I could have got up to the TCP
stream equals thirty-two filter but most of the time that's not how we set these instead we just
look at a packet that's involved in the connection we want to filter on right-click it and set that
TCP stream now sometimes we may want to set a filter not for a port or for an IP conversation
but for text word maybe we're digging for a certain username or we want to see if there's
a certain tab name and an application that's sent in the packets so to do that it's a simple filter
we can come up to clear and this time we're going to use what's called the TCP contains filter now
here I can type in any clear text word that I want to and anywhere where that word may appear in any
packet in this entire trace file will be displayed so for example I can do TCP contains Facebook if
I'm interested in seeing which devices are out there talking to Facebook now once I set that
filter if I come down into the clear text view within Wireshark I'm just scroll over because on
mine it's a little hidden this is where I can see where that actual word appears I see facebook.com
now remember that up here I set a filter for any TCP packet that contains the word Facebook
but just as easily I could wipe this and I could type in UDP contains Facebook and that would show
me all of my DNS queries to Facebook or that have that word Facebook in the packets so again this is
a very useful filter if we're looking for things like Facebook or a username or perhaps a torrent
user and again that's the TCP or UDP contains and in the string now from here we're going to
take a look at a couple very useful application filters built into Wireshark now specifically
these involve HTTP now HTTP as we know it's an application that uses requests and responses from
users so I'm gonna come up and clear my previous filter out and I come over to my filter bar and
I'm going to type in HTTP dot request what that will do is it will display all HTTP requests
involve in this trace file I can see all the gets I can see all the servers involved of the clients
involved if there's any retransmissions as we see here I'm just gonna bring my hex view a little bit
out of the way there now it's also possible that I want to filter for a specific response code so
I could go up to the bar up here and I can back out requests and I can type in response come down
to code equals equals and then I could type in 200 for the ok responses or four oh four or 500
if I suspect I have a server err whatever the case may be and that will filter only for the
HTTP responses so those are also some useful filters when I'm doing HTTP analysis now we're
just gonna look at two more display filters in this video and one of those is more related to
security so I want to set a filter to see if one of my servers is getting syn attacked I wanna
see how many syn connections are coming in to a system where they're coming from and what those
ports look like so let's do that I'm gonna clear my filter and I'm gonna come up to my filter bar
and I type in TCP dot Flags dot s Y and what I want to do is I want to be sure that all
packets with the syn bit in the TCP header set to one are displayed so this means show me all
sins and what I'm gonna look for in my patterns over here in the information I want to look for
rapidly incrementing syn connections coming from one station or two stations or whatever the case
may be into a server and that will indicate is that servers being attacked so there will just
be a single destination and these will be coming in very quick and likely there will be thousands
and thousands and thousands of them now it's also possible I could use this flags filter to look for
things like TCP resets and to do that all I got to do is remove this in and type in reset and
that will show me all TCP resets that are in the trace file now the final Wireshark display
filter that will show in this video today has to do a voice over IP now but since I don't have any
voice in this trace file I'll just show you what the filter looks like if I come up and I clear
this one now with VoIP it has both a signaling protocol and also an RTP stream so if I just
type in sip that means that I'll just get the signaling between a phone and the call manager
or that call manager in the remote phone if I type in just RTP then I'm only gonna get the RTP stream
between those two phones but to say both I can type in sip ampersand ampersand RTP in order to
get both of those together both the control and the RTP feed now I hope this top 10 Wireshark
filters video was helpful for you if you have any other questions please feel free to comment
in the line below or if you have other Wireshark filters that you like to use that you'd like to
share also please add those as well thank you for watching this video bye packet pioneer if you're
experiencing network or application performance problems and you need help resolving them please
get in touch with us at WWE TA or calm or by sending us an email at packet pioneer at gmail.com