Wireshark display filters
In a workstation’s traffic capture you find the needle in the haystack with display filters: protocol and field filters, comparison and logical operators, contains and matches, sets and network ranges, Apply as Filter and filter buttons; you export the filtered packets and at the end find, on your own, the suspicious server contacted at regular intervals.
Level 101 · 50 min
You are a new analyst in the CORP SOC (Security Operations Centre). Senior analyst Daniel gave you a traffic capture taken from a workstation: ~/ws/filtre.pcapng. "There are a few hundred packets; looking at them one by one takes a day. Use filters," he says.
A display filter shows only the packets in a capture that meet a condition; the rest are not deleted, just hidden. Analogy: telling a crowded classroom "only those in red jumpers stand up". If the filter bar turns green the expression is valid; red means a typo.
This capture differs in every lab; you must find the answers in yours. Close any Wireshark windows left open from earlier lessons: the desktop runs with 2 GB of memory.
What you will do in this lesson
- Open the capture
- A protocol filter: dns
- A field and a comparison: http.request.method == "POST"
- Logical operators and exporting
- Searching text: contains and matches
- Sets, numbers and size
- Apply as Filter and a filter button
- The server contacted at regular intervals
- The evidence file
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Filtering by protocol name (dns, http, ftp)
- Comparing fields with values (==, !=, >)
- Combining filters with &&, || and !
- Exporting only the requested packets
- Searching text with contains and matches
- Using sets, network ranges and len()
- Making a filter from a field with Apply as Filter
- Adding a permanent filter button
← Saving PCAPNG in Wireshark · Wireshark fundamentals · Wireshark capture filters (BPF) →
Start for free