Wireshark Capture Filter for General Network Traffic

As network administrators, we often need to monitor and analyze general network traffic to identify potential issues or threats. One of the most effective ways to do this is by using a capture filter in Wireshark, a powerful network protocol analyzer. In this article, we will explore how to use Wireshark capture filters for general network traffic.

Understanding Capture Filters

Capture filters are used to select specific packets from the raw network data being captured. They are set before starting a packet capture and cannot be modified during the capture process. This means that you need to carefully design your capture filter before capturing any data.

Wireshark Capture Filter for General Network Traffic

To create a Wireshark capture filter for general network traffic, you can use the following syntax:

`port 80 and not port 25`

This capture filter will capture all traffic on port 80 (HTTP) and exclude all traffic on port 25 (SMTP). This is useful if you want to capture only HTTP traffic on your server.

Another example of a Wireshark capture filter for general network traffic is:

`tcp > 1500 and tcp < 2000`

This capture filter will capture all TCP packets with a length greater than 1500 bytes and less than 2000 bytes. This can help you identify large packets that may be indicative of a problem.

Other Wireshark Capture Filters

Here are some other examples of Wireshark capture filters for general network traffic:

* `icmp=icmp-echo and ip=92 and icmp=0xAAAAAAAA`: This filter captures an ICMP echo request that is 92 bytes long and has an ICMP payload that begins with 4 bytes of A's (hex).

* `dst port 135 and tcp port 135 and ip=48`: This filter captures traffic to or from IP address 172.18.5.4.

* `(tcp > 2' figures out the TCP header length):` This filter captures all TCP packets with a length greater than 2 bytes.

* `host and not (port 80 or port 25)`: This filter captures traffic to or from any host, excluding HTTP and SMTP traffic.

In this article, we have explored how to use Wireshark capture filters for general network traffic. By using these filters, you can quickly and easily identify specific types of packets in your network traffic and troubleshoot issues more effectively. Whether you are a network administrator or a security professional, Wireshark capture filters are an essential tool in your toolkit.

References

* '1' Jefferson Ogata via the tcpdump-workers mailing list

* '2' Welchia are RPC worms