Configuring compound filters

Structure filters are simply made for writing filters out of several conditions. It uses simple conditions, such as not, and, and or for creating structured conditions.

Getting ready

Structured filters are written in the following format:

[not] primitive [and|or [not] primitive ...]

The following modifiers are commonly used in the Wireshark capture filters:

  • ! or not
  • && or and
  • || or or

How to do it...

To configure structured filters, you simply write the conditions according to what we learned in the previous recipes, with conditions to meet your requirements.

Some common filters are:

  1. For capturing only unicast packets, configure not broadcast and not multicast.
  2. For capturing HTTP packets to www.youtube.com, configure host www.youtube.com and port 80.
  3. A capture filter for telnet that captures traffic to and from a particular host, configures tcp port 23 and host 192.180.1.1.
  4. For capturing all telnet traffic not from 192.168.1.1, configure tcp port 23 and not src host 192.168.1.1.

How it works…

Some examples for structured filters:

For capturing data to tcp port 23 (Telnet) from source port range of 5000-6000, configure tcp dst port 23 and tcp src portrange 5000-6000.

There's more...

Some interesting examples are as follows:

  • host www.mywebsite.com and not (port 80 or port 23)
  • host 192.168.0.50 and not tcp port 80
  • host 10.0.0.1 and not host 10.0.0.2

See also

For more examples, you can take a look at:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.145.85.178