Embracing filter shortcuts

While working with Wireshark in the Packet Details panel, you might want to filter on a specific IP address or a particular port number. Once you identify the item of interest, you can right-click to view filter shortcuts and you will see several shortcuts, as shown here:

Right-click to view filter shortcuts

Although there are many options when you right-click, in the center are the shortcuts that deal with filters. The following options are available:

  • Apply as a Filter: When selected, it will create and run a selected field value.
  • Prepare a Filter: When selected, it will create and place a selected field value in the display filter area, giving you a chance to make any modifications or add to the filter.
  • Conversation Filter: When selected, it allows you to follow the conversations according to protocols, such as Ethernet, IPv4, and TCP, as shown in the  following screenshot:

Conversation filter selections
  • Colorize with Filter: This allows you to colorize a specific conversation. As you can see, you can select from the many available colors, or you can create your own coloring rule, as shown in the following screenshot:

 Colorize with filter

When you right-click and select either Apply as a Filter or Prepare a Filter, you will see additional choices, as shown in the screenshot named Right-click to view filter shortcuts. The following list shows how you can select simple filters or add logical operators:

  • Selected: Selects the current field value.
  • Not Selected: Creates a filter that removes the selected field. For example, if I right-click on destination port 443 and select Not Selected, then Wireshark will generate !(tcp.dstport == 443) and place it in the display filter.
  • ...and Selected: Adds a field value to the filter.
  • ...or Selected: Creates an OR filter.
  • ...and not Selected: Adds a filter that removes the selected field.
  • ...or not Selected: Creates an OR filter with a filter that removes the selected field.

After working with Wireshark for a while, you may learn some new techniques that will help improve your workflow. Using filters is one of the tools that helps you home in on a problem. The next section provides some suggestions on useful filters that can help you when searching for specific types of traffic.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
13.58.252.8