Configuring specific protocol filters

In this recipe we will have a look at the instructions and examples to configure display filters for common protocols such as DNS, HTTP, and FTP.

The purpose of this recipe is to learn how to configure filters that will help us in network troubleshooting. We will learn about network troubleshooting in the upcoming chapters.

Getting ready

To perform this recipe, you will need a running Wireshark software capture; there are no other prerequisites.

How to do it...

In this recipe we will see the display filters for some common protocols.

HTTP display filters

The following are some common HTTP display filters:

  • To display all the HTTP packets going to <"host name">, use http.request.method == <"Request methods">
  • To display packets with the HTTP GET method, use http.request.method == "GET"
  • To display the URI requested by client, use http.request.method == <"Full request URI">; for example, http.request.uri == "/v2/rating/mail.google.com"
  • To display the URI requested by the client that contains a specific string (all requests to Google in the preceding example), use http.request.uri contains "URI String"; for example, http.request.uri contains "mail.google.com"
  • To check all the cookie requests sent over the network (note that cookies are always sent from the client to the server), use http.cookie
  • To check all the cookie set commands sent from the server to the client, use http.set_cookie
  • To check all the cookies sent by Google servers to your PC, use (http.set_cookie) && (http contains "google")
  • To check all the HTTP packets that contain a ZIP file, use http matches ".zip" && http.request.method == "GET"

DNS display filters

Here, we will look at some common DNS display filters.

To display DNS queries and responses, use:

  • dns.flags.response == 0 for DNS queries
  • dns.flags.response == 1 for DNS response

To display only DNS responses with four answers or more, use dns.count.answers >= 4.

FTP display filters

Some common FTP display filters are as follows:

  • To fetch FTP request commands, use ftp.request.command == <"requested command"> - ftp.request.command == "USER"
  • To fetch FTP commands from port 2, use ftp, and to fetch FTP data from port 20 or any other configured port, use ftp-data

How it works...

The Wireshark regular expression syntax for display filters uses the same syntax as regular expressions in Perl.

Some common modifiers are as follows:

  • ^: This is used to match the beginning of the line
  • $: This is used to match the end of the line
  • |: This is used for alternation purposes
  • (): This is used for grouping purposes
  • *: This is used to match either 0 or more times
  • +: This is used to match 1 or more times
  • ?: This is used to match 1 or 0 times
  • {n}: This is used to match exactly n times
  • {n,}: This is used to match at least n times
  • {n,m}: This is used to match at least n but not more than m times

You can use these modifiers to configure more complex filters. Have a look at the following examples:

  • To look for HTTP GET commands that contain ZIP files, use http.request.method == "GET" && http matches ".zip" && !(http.accept_encoding == "gzip, deflate")
  • To look for HTTP GET commands that contain ZIP files, use http.request.method == "GET" && http matches ".zip" && !(http.accept_encoding == "gzip, deflate")
  • To look for HTTP messages that contain websites that end with .com, use http.host matches ".com$"

See also

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.226.180.161