Wireshark 101: Display Filters and Filter Options

On today's HakTip, Shannon Morse discusses the Display Filter Box and several options you have for saving filters within Wireshark.

One question I got from last week's episode was "What happens to the rest of your packets when you use the filter box?". This box is for Display Filters. Whenever you use it after running a packet capture, it'll just display whatever you typed in. Everything else is simply omitted until you clear the filter text box. The Expression box will basically fill in the expressions the same way. Click Expression, then choose a Field name and preferred expression. Choose the relation, and the value. The value for an IPV4 protocol would be an IP address. You can also choose from predefined values if available. Once you hit OK the new filter will show up in the filter box. Hit enter to run that filter. If you want to save your filter, hit save, name it, and hit OK. How you can just click on the bookmarked filter and it'll run. Let's have some more fun. If you want to view packets of a specific size, use frame.len <= 128. I could also use ==, !=, >, <, <=, or >=. And if I have two expressions I want to combine, use the &&, ||, not, or xor. xor means one and only one condition must be true. Nor means neither condition is true.

You might end up writing out a really long filter. You have a lot of options to save them, luckily. You can use the save button next to the filter display box. Of you can use the filter button next to the box. Lastly, you can also use the analyze --> display filters option.

Now let's have some fun with Endpoints. These are where the data is going to and coming from, so there's usually a two-ended conversation happening within your packet captures. To see traffic between endpoints, click Statistics --> Endpoints. Clicking Statistics --> Conversations will show you address A and address B for each conversation, separated by protocol.

Let me know what you think. Send me a comment below or email us at tips@hak5.org. And be sure to check out our sister show, Hak5 for more great stuff just like this. I'll be there, reminding you to trust your technolust.