Wireshark 101: Display Filters and Filter Options, HakTip 122

Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
____________________________________________
On today's HakTip, Shannon Morse discusses the Display Filter Box and several options you have for saving filters within Wireshark.
One question I got from last week's episode was "What happens to the rest of your packets when you use the filter box?". This box is for Display Filters. Whenever you use it after running a packet capture, it'll just display whatever you typed in. Everything else is simply omitted until you clear the filter text box. The Expression box will basically fill in the expressions the same way. Click Expression, then choose a Field name and preferred expression. Choose the relation, and the value. The value for an IPV4 protocol would be an IP address. You can also choose from predefined values if available. Once you hit OK the new filter will show up in the filter box. Hit enter to run that filter. If you want to save your filter, hit save, name it, and hit OK. How you can just click on the bookmarked filter and it'll run. Let's have some more fun. If you want to view packets of a specific size, use frame.len less than sign= 128. I could also use ==, !=, greater than sign, less than sign, less than sign=, or greater than sign=. And if I have two expressions I want to combine, use the &&, bracket bracket, not, or xor. xor means one and only one condition must be true. Nor means neither condition is true.
You might end up writing out a really long filter. You have a lot of options to save them, luckily. You can use the save button next to the filter display box. Of you can use the filter button next to the box. Lastly, you can also use the analyze -- display filters option.
Now let's have some fun with Endpoints. These are where the data is going to and coming from, so there's usually a two-ended conversation happening within your packet captures. To see traffic between endpoints, click Statistics -- Endpoints. Clicking Statistics -- Conversations will show you address A and address B for each conversation, separated by protocol.
Let me know what you think. Send me a comment below or email us at [e-mail]. And be sure to check out our sister show, Hak5 for more great stuff just like this. I'll be there, reminding you to trust your technolust.
~-~~-~~~-~~-~
Please watch: "Bash Bunny Primer - Hak5 2225"
• Bash Bunny Primer - Ha...
~-~~-~~~-~~-~
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community - where all hackers belong.

[@sanjdkum]

love the way you explain the things, one time hear it and you got the concepts :) thanks much !!

[@Denstoradiskmaskinen]

I had not seen the endpoint conversations before, from it i learned about something going on in my private network! Nice!

[@JasonDriskillDFWChef]

Great video! Thank you so much.

[@GeekyAfros]

Omggg!!! I’m so glad I found uuuuuu!!! 😌🤓

[@DesertFernweh]

Super Much Fun times!!! I am using that!

[@MrBSPQC]

I was doing a work for class and was stuck into multiple filters application.
Thank you so much for helping!

[@VasilisTriantafyllou]

all this great info in so little time ...i love it!

[@ShannonMorse]

I try! :D

[@hragarabaghyan1886]

thanks a lot! this was really helpful :)

[@Crazy52]

i hear data length is a better filter than frame length due to frame length being able to change size more often.
too bad i dont think there is a display filter for data length in "Tshark"
You can also talk about how to use wireshark over SSH.

[@hackza8379]

very good thank you!
how can i find out how many routers and networks on my internal networks using Wireshark?

[@sgtfoose8842]

I want to learn how to read communication between hardware devices. In my case a control system and lets say an AV Amplifier in order to control them and get feedback from the device. Most hardware comes with a protocol but sometimes not. Would you recommend to use "Conversations" for this purpose?

[@truthRevealed73]

you are awesome.

[@mthrghl]

Hello mam I want to know how to change the display filter to string because I watched a video it said change to string but I can't find that

[@securitytraining6018]

i could not stop staring at her ip

[@KowboyUSA]

Two viewers must have accidentally gave the video thumb downs.