Wireshark, a tool used for creating and analyzing PCAPs (network packet capture files), is commonly used as one of the best packet analysis tools. Wireshark can run on Windows, macOS, and Linux. To begin installing Wireshark on a Windows or macOS device you will need to first grab an installer from the Wireshark website. Once you have downloaded an installer, simply run it and follow the GUI wizard.
If you are using Linux you can install Wireshark with apt install Wireshark
Filtering Operators
Wireshark's filter syntax can be simple to understand making it easy to get a hold of quickly. To get the most out of these filters you need to have a basic understanding of Boolean and logic operators.
Wireshark only has a few that you will need to be familiar with:
Basic Filtering Syntax
Filtering by IP
ip.addr == <IP Address>
Filtering by SRC and DST IP
ip.src == <SRC IP Address> and ip.dst == <DST IP Address>
Filtering by TCP Protocols
tcp.port eq <Port #> or <Protocol Name>
Filtering by UDP Protocols
udp.port eq <Port #> or <Protocol Name>
Show only SMTP (port 25) and ICMP traffic:
tcp.port eq 25 or icmp
Show only traffic in the LAN (192.168.x.x), between workstations and servers
ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16
Show HTTP or DNS traffic:
http or dns
Show all traffic except ARP, ICMP and DNS:
!(arp or icmp or dns)
Interface Filters
Show packets only sent or received on the wlan0 interface:
frame.interface_name == "wlan0"
Link Layer Traffic
To show ARP traffic:
arp
how ARP protocol frames sent from device with MAC address 00:c0:ca:96:cf:cb:
arp.src.hw_mac == 00:c0:ca:96:cf:cb
Show ARP protocol frames sent from a device with an IP address 192.168.50.90:
arp.src.proto_ipv4 == 192.168.50.90
Show ARP protocol frames sent to a device with a MAC address 00:00:00:00:00:00 (this address is used when the protocol tries to find out the target MAC address.
arp.dst.hw_mac == 00:00:00:00:00:00
Show ARP protocol frames sent to the device having the IP address 192.168.50.1:
arp.dst.proto_ipv4 == 192.168.50.1
Show Ethernet traffic
eth
Show frames (in general, all frames, not just ARP, as it was in the previous examples) sent from a device that has the MAC address 00:c0:ca:96:cf:cb:
eth.src == 00:c0:ca:96:cf:cb
Show frames sent to device with MAC address 78:cd:8e:a6:73:be:1
eth.dst == 78:cd:8e:a6:73:be
Internet Layer Traffic
IPv4 Protocol Filtering
Show IP traffic (this includes TCP, UDP, as well as application layer protocols DNS, HTTP - that is, almost everything except the data link layer protocols that do not use IP addresses for data transmission (in local Ethernet networks they use MAC addresses)):
ip
Show traffic associated with a specific IP address (enter it instead of x.x.x.x). Packets will be shown in which this IP address is the source of the data OR the recipient:
ip.addr == x.x.x.x
Show traffic associated with these two IP addresses. According to the only possible situation, one of these addresses is the source, and the second is the destination address.
ip.addr == x.x.x.x && ip.addr == y.y.y.y
Show traffic originated from the host with the IP address 138.201.81.199:
ip.src == 138.201.81.199
Show traffic whose destination is the host with the IP address 138.201.81.199:
ip.dst == 138.201.81.199
Filter subnets and IP ranges in Wireshark
You can specify a subnet instead of a single IP address:
ip.addr == 192.168.1.0/24
Filtering traffic sent from a specific IP range. If you need to filter out traffic whose source is the subnet, then use a filter of the form:
ip.src == 192.168.1.0/24
Filtering traffic destined for sending to a specific IP range. If you need to filter traffic whose destination is a subnet, then use a filter of the form:
ip.dst == 192.168.1.0/24
Application layer traffic
For the application protocols of HTTP, DNS, SSH, FTP, SMTP, RDP, SNMP, RTSP, GQUIC, CDP, LLMNR, SSDP there are filters that are called like the protocols themselves, but are written in small letters.
For example, to see HTTP traffic:
http
To see the traffic of the new HTTP/2 protocol:
http2
NOTE: Remember that when deciding which protocol the transmitted data belongs to, the program considers the used port number. If a non-standard port is used, the program will not be able to find the necessary data. For example, if you connect to SSH on port 1234, the ssh filter will not find SSH traffic.
A filter that shows only the data sent by the POST method:
http.request.method == "POST"
A filter that shows only the data transmitted by the GET method:
http.request.method == "GET"
Search for requests to a specific site (host):
http.host == "<URL>"
Search requests to a specific site by part of the name:
http.host contains "here.particle.name"
Filter for outputting HTTP requests in which cookies were transmitted:
http.cookie
Requests in which the server has set cookies in the user's browser.
http.set_cookie
To search for any transferred images:
http.content_type contains "image"
To search for certain types of images:
http.content_type contains "gif"
http.content_type contains "jpeg"
http.content_type contains "png"
To search for files of a specific type:
http.content_type contains "text"
http.content_type contains "xml"
http.content_type contains "html"
http.content_type contains "json"
http.content_type contains "javascript"
http.content_type contains "x-www-form-urlencode"
http.content_type contains "compressed"
http.content_type contains "application"
Search for requests for files of a certain type. For example, to search for transferred ZIP archives:
http.request.uri contains "zip"
Instead of http.request.uri for greater accuracy, you can use the http.request.uri.path or http.request.uri.query filters, for example, to search for requests to download JPG files (links to pictures):1
http.request.uri.path contains "jpg"
You can also filter requests that contain a specific HTTP REFERRER header value. For example, to search for queries in which the referrer is ru-board.com:
http.referer contains "ru-board.com"
To investigate problems, you can analyze the status of HTTP response codes. For example, the following filter will show traffic for which a 404 Not Found error was received (page not found):
http.response.code==404
you can use the filter without specifying the desired value, for example:
http.host
In this case, all connections with any Host field value in the HTTP header will be shown.
You can specify the exact value:
http.host == "www.archlinux.org"
Or specify part of the desired string:
http.host contains "archlinux.org"
Filter by Host field in HTTP header:
http.host == "www.archlinux.org"
Filter by the Content-Type field in the HTTP header:
http.content_type == "text/plain"
Filter by Server field in HTTP header:
http.server == "nginx"
Filter by Cookie field in HTTP header:
http.cookie
http.cookie_pair
Filter by User Agent field in HTTP header:
http.user_agent == "Mozilla/5.0 (X11; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0"
To search for redirects (Location field):
http.location
To search for sites from which a transition was made to the page (Referer field):
http.referer contains "sysnetnotes.blogspot.com"
Request filter:
http.request
http.request.uri
http.request.uri.path
http.request.uri.query.
http.request.uri.query.parameter
http.request.method
Response filters:
http.response
Search by response code:
http.response.code == 404
http.response.code==200
In fact, this list is far from complete. You can use the hints that appear as you type the names of the filters, or you can be guided by the names of the HTTP header fields, which are similar to the names of the filters.
Detecting Network Attacks with Wireshark
This section contains Wireshark filters that could help in identifying adversaries trying to find alive systems on our network.
Using these filters we should be able to detect various network discovery scans, ping sweeps and other things typically done during reconnaissance (asset discovery) phase.
| Technique | Wireshark Filter | Command / Tool |
|---|---|---|
| ARP scanning | arp.dst.hw_mac==00:00:00:00:00:00 | arp-scan -l |
| IP protocol scan | icmp.type==3 and icmp.code==2 | nmap -sO <target> |
| ICMP ping sweep | icmp.type==8 or icmp.type==0 | nmap -sn -PE <subnet> |
| TCP ping sweeps | tcp.dstport==7 | nmap -sn -PS/-PA <subnet> |
| UDP ping sweeps | udp.dstport==7 | nmap -sn -PU <subnet> |
Detection of network port scanning
| Technique | Wireshark Filter | Command / Tool |
|---|---|---|
| TCP SYN scan | tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size<=1024 | nmap -sS <target> |
| TCP Connect() scan | tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size>1024 | nmap -sT <target> |
| TCP Null scan | tcp.flags==0 | nmap -sN <target> |
| TCP FIN scan | tcp.flags==0x001 | nmap -sF <target> |
| TCP Xmass scan | tcp.flags.fin==1 && tcp.flags.push==1 && tcp.flags.urg==1 | nmap -sX <target> |
| UDP port scan | icmp.type==3 and icmp.code==3 | nmap -sU <target> |
Detection of network attacks
| Technique | Wireshark Filter | Command / Tool |
|---|---|---|
| ARP poisoning | arp.duplicate-address-detected or arp.duplicate-address-frame | arpspoof, ettercap |
| ICMP flood | icmp and data.len > 48 | fping, hping |
| VLAN hoping | dtp or vlan.too_many_tags | frogger, yersinia |
| Unexplained packet loss | tcp.analysis.lost_segment or tcp.analysis.retransmission | n/a |
