Geek Answers Handbook

Wireshark filtering for ip-port pair (display filter)

I would like to know how to make a display filter for the ip port in wirehark.

So, for example, I want to filter the ip port 10.0.0.1:80, so it will find the whole message with 10.0.0.1:80, but not with 10.0.0.1:235, but on another ip on port 80.

+7
source share
3 answers

I want to filter out an ip-port pair for any protocol that supports ports. Or tcp or udp. This ip-por pair can access any other ip on any port.

(ip.src == XXX.XXX.XXX.XXX && (tcp.srcport == YYY || udp.srcport == YYY)) || (ip.dst == XXX.XXX.XXX.XXX && (tcp.dstport == YYY || udp.dstport == YYY) (ip.src == XXX.XXX.XXX.XXX && (tcp.srcport == YYY || udp.srcport == YYY)) || (ip.dst == XXX.XXX.XXX.XXX && (tcp.dstport == YYY || udp.dstport == YYY) will match:

  • All packets coming from IPv4 XXX.XXX.XXX.XXX and TCP or UDP YYY ports;
  • all packets going to the IPv4 address XXX.XXX.XXX.XXX and the TCP or UDP port YYY;

which sounds like it's what you want. (If this is not what you want, you need to be more specific and precise about what you want.)

+15
source

Try this filter:

 (ip.src==10.0.0.1 and tcp.srcport==80) or (ip.dst==10.0.0.1 and tcp.dstport==80)

Since you have two ports and two IP addresses in tcp / ip packets, you need to specify exactly which source and target sockets you want.

+2
source

IP protocol does not define something like a port. Two protocols over IP have TCP and UDP ports.

If you want to display only TCP connection packets sent from port 80 on one side and on port 80 on the other, you can use this display filter:

 tcp.srcport==80 && tcp.dstport==80

Similarly, you can define a filter for UDP communications. You can narrow the filter with additional conditions, for example

 ip.srcaddr==1.2.3.4

or

 ip.addr==55.66.77.88

You can even use C && and || style statements as well as parentheses to create sophisticated filters.

 (ip.addr==128.100.1.1 && tcp.port==80) || (ip.addr==10.1.2.1 && udp.port==68)

What you really want to filter is your decision.

+1
source

More articles:


All Articles