Thursday, July 31, 2014

Easy packet filtering with Wireshark

Wireshark the ultimate tool to solve network problems have so many filter possibilities, that it is often very difficult to find the correct one for your need in the Filter expression dialog.

Wireshark filter expression

But fortunately there is an easy way to create a filter. Simply click on the field in the packet trace detail for which you want to create a filter with the right mouse button and choose the correct "Apply as Filter" context menu. If you have already set a filter and want to add the field as an additional filter criteria choose one of the "... xxxx" entries. That's so easy that i am really angry i had not known this earlier.

Apply wireshark filter with context menu

Another tip for beginners of wireshark is to use the Follow TCP or UDP Stream Context Menu. When you select this option on a packet you get the whole communication to which this packet belongs.

Follow TCP Stream in Wireshark

This is very useful to analyze http traffic or to solve problems in REST communications.

No comments:

Post a Comment