> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/red-team/sniffing/wireshark.md).

# Wireshark

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, communications protocol development, and education. It allows you to capture and interactively browse the traffic running on a computer network.

***

### Filters

Wireshark uses two types of filters:

* **Capture Filters**: Set *before* starting the capture. Filters what traffic gets collected.
* **Display Filters**: Set *after* capture. Filters what is shown in the interface.

***

## Capture Filters

These filters apply **before** capturing starts and reduce the amount of traffic saved.

#### Examples:

| What it does                     | Filter               |
| -------------------------------- | -------------------- |
| Capture only HTTP traffic        | `port 80`            |
| Capture traffic from an IP       | `host 192.168.1.1`   |
| Capture only TCP traffic         | `tcp`                |
| Capture traffic on subnet        | `net 192.168.1.0/24` |
| Capture traffic to specific port | `dst port 443`       |

***

## Display Filters

These filters apply **after** the traffic is captured. Useful for analyzing specific protocols or communication.

***

### Operators

| Operator  | Symbol | Description         |
| --------- | ------ | ------------------- |
| Equal     | `==`   | Matches exact value |
| Not Equal | `!=`   | Excludes value      |
| Greater   | `>`    | Greater than        |
| Less      | `<`    | Less than           |
| GE        | `>=`   | Greater or equal    |
| LE        | `<=`   | Less or equal       |

***

### Logical Operators

| Logic Type | Symbol | Description                  |
| ---------- | ------ | ---------------------------- |
| AND        | `&&`   | Both conditions must be true |
| OR         | `\|\|` | At least one must be true    |
| NOT        | `!`    | Negates condition            |
| XOR        | `^^`   | Only one condition is true   |

***

#### Filter Examples

***

**IP Address Filters**

| What it does   | Filter                    |
| -------------- | ------------------------- |
| Any IP match   | `ip.addr == 192.168.1.10` |
| Source IP      | `ip.src == 192.168.1.10`  |
| Destination IP | `ip.dst == 192.168.1.10`  |

***

**MAC Address Filters**

| What it does    | Filter                          |
| --------------- | ------------------------------- |
| Any MAC match   | `eth.addr == 94:08:53:a0:1b:31` |
| Source MAC      | `eth.src == 94:08:53:a0:1b:31`  |
| Destination MAC | `eth.dst == 94:08:53:a0:1b:31`  |

***

**TCP Filters**

| What it does         | Filter               |
| -------------------- | -------------------- |
| TCP source port      | `tcp.srcport == 80`  |
| TCP destination port | `tcp.dstport == 443` |
| TCP ACK flag set     | `tcp.flags.ack == 1` |
| TCP SYN flag set     | `tcp.flags.syn == 1` |

***

**HTTP Filters**

| What it does                        | Filter                                                        |
| ----------------------------------- | ------------------------------------------------------------- |
| HTTP GET request                    | `http.request.method == "GET"`                                |
| HTTP POST request                   | `http.request.method == "POST"`                               |
| Specific URI path                   | `http.request.uri.path == "/"`                                |
| Requests with specific cookies      | `http.cookie`                                                 |
| Requests using Authorization header | `http.authorization`                                          |
| Match GET or 302 response           | `http.request.method == "GET" \|\| http.response.code == 302` |

***

**Text Match (Payload Search)**

| What it does                   | Filter                   |
| ------------------------------ | ------------------------ |
| Show packets containing text   | `frame contains "login"` |
| Show packets containing "auth" | `frame contains "auth"`  |