Book Image

Wireshark Revealed: Essential Skills for IT Professionals

By : James H Baxter, Yoram Orzach, Charit Mishra
Book Image

Wireshark Revealed: Essential Skills for IT Professionals

By: James H Baxter, Yoram Orzach, Charit Mishra

Overview of this book

This Learning Path starts off installing Wireshark, before gradually taking you through your first packet capture, identifying and filtering out just the packets of interest, and saving them to a new file for later analysis. You will then discover different ways to create and use capture and display filters. By halfway through the book, you'll be mastering Wireshark features, analyzing different layers of the network protocol, and looking for any anomalies.We then start Ethernet and LAN switching, through IP, and then move on to TCP/UDP with a focus on TCP performance problems. It also focuses on WLAN security. Then, we go through application behavior issues including HTTP, mail, DNS, and other common protocols. This book finishes with a look at network forensics and how to locate security problems that might harm the network.This course provides you with highly practical content explaining Metasploit from the following books: 1) Wireshark Essentials 2) Network Analysis Using Wireshark Cookbook 3) Mastering Wireshark
Table of Contents (5 chapters)

Chapter 3. Using Display Filters

In this chapter you will learn the following:

  • Configuring display filters
  • Configuring Ethernet, ARP, host, and network filters
  • Configuring TCP/UDP filters
  • Configuring specific protocol filters
  • Configuring substring operator filters
  • Configuring macros

Introduction

In this chapter we will learn how to work with display filters. Display filters are filters that we apply after capturing data (filtered by capture filters or not), and when we wish to display only part of the data.

Display filters can be implemented in order to locate various types of data:

  • Parameters such as the IP address, TCP or UDP port numbers, URLs, and server names
  • Conditions such as "packet length shorter than..." and the TCP port range
  • Phenomena such as TCP retransmissions, duplicate and other types of ACKs, various protocol error codes, and flag existence
  • Various applications parameters such as Short Message Service (SMS) source and destination numbers and Server Message Block...