Wireshark
Is the world’s foremost and widely-used network protocol analyzer.
Installation
sudo apt install wireshark
Usage
wireshark [options] ... [ <infile> ]
Flags
Capture interface:
-i <interface> name or idx of interface (def: first non-loopback)
-f <capture filter> packet filter in libpcap filter syntax
-s <snaplen> packet snapshot length (def: appropriate maximum)
-p don't capture in promiscuous mode
-k start capturing immediately (def: do nothing)
-S update packet display when new packets are captured
-l turn on automatic scrolling while -S is in use
-I capture in monitor mode, if available
-B <buffer size> size of kernel buffer (def: 2MB)
-y <link type> link layer type (def: first appropriate)
--time-stamp-type <type> timestamp method for interface
-D print list of interfaces and exit
-L print list of link-layer types of iface and exit
--list-time-stamp-types print list of timestamp types for iface and exit
Capture stop conditions:
-c <packet count> stop after n packets (def: infinite)
-a <autostop cond.> ... duration:NUM - stop after NUM seconds
filesize:NUM - stop this file after NUM KB
files:NUM - stop after NUM files
Capture output:
-b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
filesize:NUM - switch to next file after NUM KB
files:NUM - ringbuffer: replace after NUM files
Input file:
-r <infile> set the filename to read from (no pipes or stdin!)
Processing:
-R <read filter> packet filter in Wireshark display filter syntax
-n disable all name resolutions (def: all enabled)
-N <name resolve flags> enable specific name resolution(s): "mnNtdv"
-d <layer_type>==<selector>,<decode_as_protocol> ...
"Decode As", see the man page for details
Example: tcp.port==8888,http
--enable-protocol <proto_name>
enable dissection of proto_name
--disable-protocol <proto_name>
disable dissection of proto_name
--enable-heuristic <short_name>
enable dissection of heuristic protocol
--disable-heuristic <short_name>
disable dissection of heuristic protocol
User interface:
-C <config profile> start with specified configuration profile
-Y <display filter> start with the given display filter
-g <packet number> go to specified packet number after "-r"
-J <jump filter> jump to the first packet matching the (display)
filter
-j search backwards for a matching packet after "-J"
-m <font> set the font name used for most text
-t a|ad|d|dd|e|r|u|ud output format of time stamps (def: r: rel. to first)
-u s|hms output format of seconds (def: s: seconds)
-X <key>:<value> eXtension options, see man page for details
-z <statistics> show various statistics, see man page for details
Output:
-w <outfile|-> set the output filename (or '-' for stdout)
Miscellaneous:
-h display this help and exit
-v display version info and exit
-P <key>:<path> persconf:path - personal configuration files
persdata:path - personal data files
-o <name>:<value> ... override preference or recent setting
-K <keytab> keytab file to use for kerberos decryption
--display=DISPLAY X display to use
--fullscreen start Wireshark in full screen
Cheat Sheet
Common Filtering Commands
USAGE |
FILTER SYNTAX |
Wireshark Filter by IP |
ip.add == 10.10.50.1 |
Filter by Destination IP |
ip.dest == 10.10.50.1 |
Filter by Source IP |
ip.src == 10.10.50.1 |
Filter by IP range |
ip.addr >= 10.10.50.1 and ip.addr <=10.10.50.100 |
Filter by Multiple Ips |
ip.addr == 10.10.50.1 and ip.addr == 10.10.50.100 |
Filter out IP adress |
! (ip.addr == 10.10.50.1) |
Filter subnet |
ip.addr == 10.10.50.1/24 |
Filter by port |
tcp.port == 25 |
Filter by destination port |
tcp.dstport == 23 |
Filter by ip adress and port |
ip.addr == 10.10.50.1 and Tcp.port == 25 |
Filter by URL |
http.host == “host name” |
Filter by time stamp |
frame.time >= “June 02, 2019 18:04:00” |
Filter SYN flag |
Tcp.flags.syn == 1 and tcp.flags.ack ==0 |
Wireshark Beacon Filter |
wlan.fc.type_subtype = 0x08 |
Wireshark broadcast filter |
eth.dst == ff:ff:ff:ff:ff:ff |
Wireshark multicast filter |
(eth.dst[0] & 1) |
Host name filter |
ip.host = hostname |
MAC address filter |
eth.addr == 00:70:f4:23:18:c4 |
RST flag filter |
tcp.flag.reset == 1 |
Default Columns In a Packet Capture Output
NAME |
DESCRIPTION |
No. |
Frame number from the beginning of the packet capture |
Time |
Seconds from the first frame |
Source (src) |
Source address, commonly an IPv4, IPv6 or Ethernet address |
Destination (dst) |
Destination address |
Protocol |
Protocol used in the Ethernet frame, IP packet, or TC segment |
Length |
Length of the frame in bytes |
Logical Operators
OPERATOR |
DESCRIPTION |
EXAMPLE |
and or && |
Logical AND |
All the conditions should match |
or or || |
Logical OR |
Either all or one of the conditions should match |
xor or ^^ |
Logical XOR |
Exclusive alterations – only one of the two conditions should match not both |
not or ! |
Not (Negation) |
Not equal to |
[ n ] [ … ] |
Substring operator |
Filter a specific word or text |
Filtering Packets (Display Filters)
OPERATOR |
DESCRIPTION |
EXAMPLE |
eq or == |
Equal |
ip.dest == 192.168.1.1 |
ne or != |
Not equal |
ip.dest != 192.168.1.1 |
gt or > |
Greater than |
frame.len > 10 |
it or < |
less than |
frame.len < 10 |
ge or >= |
Greater than or equal |
frame.len >= 10 |
le or <= |
Less than or equal |
frame.len <= 10 |
Filter Types
NAME |
DESCRIPTION |
Capture filter |
Filter packets during capture |
Display filter |
Hide packets from a capture display |
Wireshark Capturing Modes
NAME |
DESCRIPTION |
Promiscuous mode |
Sets interface to capture all packets on a network segment to which it is associated to |
Monitor mode |
Setup the wireless interface to capture all traffic it can receive (Unix/ Linux only) |
Miscellaneous
NAME |
DESCRIPTION |
Slice Operator |
[ … ] – Range of values |
Membership Operator |
{} – In |
CTRL+E |
Start/Stop Capturing |
Capture Filter Syntax
SYNTAX |
PROTOCOL |
DIRECTION |
HOSTS |
VALUE |
LOGICAL OPERATOR |
EXPRESSIONS |
Example |
tcp |
src |
192.168.1.1 |
80 |
and |
tcp dst 202.164.30.1 |
Display Filter Syntax
SYNTAX |
PROTOCOL |
STRING 1 |
STRING 2 |
COMPARISON OPERATOR |
VALUE |
LOGICAL OPERATOR |
EXPRESSIONS |
Example |
http |
dest |
ip |
== |
192.168.1.1 |
and |
tcp port |
Keyboard Shortcuts – Main Display Window
ACCELERATOR |
DESCRIPTION |
ACCELERATOR |
DESCRIPTION |
Tab or Shift+Tab |
Move between screen elements, e.g. from the toolbars to the packet list to the packet detail. |
Alt+→ or Option→ |
Move to the next packet in the selection history. |
↓ |
Move to the next packet or detail item. |
→ |
In the packet detail, opens the selected tree item. |
↑ |
Move to the previous packet or detail item. |
Shift+→ |
In the packet detail, opens the selected tree items and all of its subtrees. |
Ctrl+ ↓ or F8 |
Move to the next packet, even if the packet list isn’t focused. |
Ctrl+→ |
In the packet detail, opens all tree items. |
Ctrl+ ↑ Or F7 |
Move to the previous packet, even if the packet list isn’t focused |
Ctrl+← |
In the packet detail, closes all the tree |
Ctrl+. |
Move to the next packet of the conversation (TCP, UDP or IP). |
Backspace |
In the packet detail, jumps to the parent node. |
Ctrl+, |
Move to the previous packet of the conversation (TCP, UDP or IP). |
Return or Enter |
In the packet detail, toggles the selected tree item. |
Examples
Filter IPs from PCAP
Command to extract IPs from captured PCAP-file.
$ tcpdump -r capture.pcapng 'ip' -n | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | sort -u
reading from file capture.pcapng, link-type EN10MB (Ethernet)
0.0.0.0
10.30.100.204
104.26.10.153
13.107.18.11
140.82.112.26
140.82.121.4
URL List