Book Image

Wireshark Network Security

By : Piyush Verma
Book Image

Wireshark Network Security

By: Piyush Verma

Overview of this book

Table of Contents (14 chapters)
Wireshark Network Security
Credits
About the Author
Acknowledgment
About the Reviewers
www.PacktPub.com
Preface
Index

Important display filters


In this section, we will look at some display filters which will come handy in day-to-day protocol analysis with regard to security.

Filters based on protocols

In this section, we will look at some of the most useful display filters for the more common protocols.

DNS

The commonly used display filters for DNS are as follows:

dns
dns.query.response == 0 
dns.query.response == 1
dns.flags.rcode == 2 [Server Failure]

FTP

Some of the common display filters that can be used while traversing FTP communication are as follows:

  1. ftp.request.command == "USER": This filter is used to filter data based on a specific FTP command. A list of FTP commands can be found at http://en.wikipedia.org/wiki/List_of_FTP_commands.

  2. ftp.request.arg == "anonymous": We may use this filter to narrow down on the precise arguments passed to the FTP commands.

  3. ftp.response.code == 530: Filtering for specific FTP response codes can help us identify any specific issues on the network. For example, if we see...