Shulou(Shulou.com)06/03 Report--

This article mainly explains "what is the capture filter of Wireshark". The explanation in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "what is the capture filter of Wireshark".

01 introduction

First, take a look at why you need to capture the filter. For example, on a server (TCPsever, port 5005), a client (a device from another company) runs for a few days and then suddenly goes offline. At this time, it is not clear whether the server kicks the client offline or the client takes the initiative offline.

Of course, at this time, you can add log records to the server, you can find the "real killer". If the other party's equipment is offline actively and the other party does not cooperate, the other party "does not believe your log". At this time, use wireshark to grab the bag, find out the evidence of the disconnection of the FIN sent by the other device (TCPClient), and then "throw" him in the face.

In fact, in the above scenario, I also mentioned the solution in the article "how do I use wireshark software", using the strategy of display filtering and saving, but this will lead to a large package file in a few days of grabbing the package. Capture filtering can solve this problem.

Capture filtering usage

1. Select capture-> capture filter, and then edit a new capture filter option: name "port5005" (according to your own needs) and filter "port5005".

two。 Select the network card in the start interface, then click ②, and select the new input capture condition created in the previous step.

3. Start capturing

After selecting the input capture conditions, as shown in the following figure, double-click the network card directly to start the capture.

02BPF syntax

The capture filter is applied to WinPcap and uses the BerkeleyPacketFilter (BPF) syntax. This syntax is widely used in a variety of packet sniffing software, mainly because most packet sniffing software relies on libpcap/WinPcap libraries that use BPF. Mastering the BPF syntax is critical for you to explore the network more deeply at the packet level.

Filters created using BPF syntax are called expressions, and expressions contain one or more primitives. Each primitive contains one or more qualifiers, followed by an ID name or number, such as:

The BPF syntax also supports the following logical operators to create more advanced expressions.

Hongmeng official Strategic Cooperation to build HarmonyOS Technology Community

Concatenation operator with (& &)

Select operator or (| |)

The negative operator is not (!)

Examples are as follows:

Src 192.168.0.10 & & port 5005

The above expression only captures traffic with a source address of 192.168.0.10 and a source or destination port of 5005.

03 filtering example

Commonly used filtering examples

Pay attention to the flexible use of the logical operators mentioned above.

Thank you for your reading, the above is the content of "what is the capture filter of Wireshark". After the study of this article, I believe you have a deeper understanding of what the capture filter of Wireshark is, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.