Wireshark

Frame number from the begining of the packet capture No.

Seconds from the first frame Time

Source address, commonly an IPv4, IPv6 or Ethernet address Source (src)

Packet Columns
Destination adress Destination (dst)

Protocol used in the Ethernet frame, IP packet , or TC segment Protocol

Length of the frame in by tes Length

and or && Logical AND All the conditions should match

or or || Logical OR Either all or one of the condtions should match

Exclusive alterations - only one of the two conditions should match not
Logical Operators xor or ^ ^ Logical XOR
both

not ot ! Not (Negation) Not equal to

[n][...] Substring operator Filter a specific word or text

ip.dest == 192.168.1.1 Equal eq or ==

ip.dest != 192.168.1.1 Not equal ne or !=

frame. len > 10 Greater than gt or >

Packet Filter
frame.len <10 less than it or <

frame. len >= 10 Greater than or equal ge or <=

frame. len <= 10 Less than or equal le or <=

Capture Filter Filter packets during capture

Filter Types
Display Fiilter Hide packets from a capture display

Sets interface to capture all packets on a network segment to which it is

Promiscuous mode
associated to
Capturing Modes
Setup the wireless interface to capture all traffic it can receive (Unix/
Monitor Mode
Linux only)

Slice Operator [ ... ] Range of values

Miscellaneous Membership Operator {} - In

CTRL + E Start/Stop Capturing

tcp src 192.168.1.1 80 and tcp dst 202.164.30.1 Capture Filter Syntax

Display Filter Syntax http dest dest == 192.168.1.1 and tcp port

Move between screen elements, e.g. from the toolbars to the packet list
Move to the next packet in the selection history. Atl + → or option + → Tab or Shift + Tab
to the packet detail.
In the packet detail, opens the selected tree item. → ↓ Move to the next packet or detail item.
In the packet detail, open the selected tree items and all of its subtrees. Shift + → ↑ Move to the previous packet or detail item.
In the packet detail, opens all tree items. Ctrl + → Keyboard Shortcuts Ctrl + ↓ or F8 Move to the next packet, even if the packet list isn't found
In the packet detail, close all the tree items. Ctrl + ← Ctrt + ↑ or F7 Move to the previous packet, even if the packet list isn't found
In the packet detail, jumps to the parent node. Backspace Ctrl + . Move to next packet of the conversation (TCP, UDP or IP).
In the packet detail, toggles the selected tree item. Return or Enter Ctrl + , Move to the previous packet of the conservation (TCP, UDP or IP).

lat ether

sca fddi

moprc ip
Protocols
mopdl arp

tcp rarp

udp decnet

Wireshark Filter by IP ip.add == 192.168.0.2

http.host == "host name" Filter by URL
Filter by Destination IP ip.dest == 192.168.0.2
frame.time >= "Feb 02, 2023 18:10:00" Filter by time stamp
Filter by Source IP ip.src == 192.168.0.2
tcp.flag.syn == 1 and tcp.flags.ack == 0 Filter SYN Flag
Filter by IP range ip.addr >=192.168.0.2 and ip.addr <= 192.168.0.200
waln.fc.type_subtype = 0x08 Wireshark Beacon Filter
Filter by Multiple Ips ip.addr == 192.168.0.2 and ip.addr == 192.168.0.20
eth.dst == ff:ff:ff:ff:ff:ff Wireshark Broadcast Filter Common Filtering Commands
Filter out IP address !(ip.addr == 192.168.0.2)
(eth.dst[0] &1) Wireshark Mutlicast Filter
Filter subnet ip.addr == 192.168.0.2/24
ip.host = hostname Host name Filter
Filter by port tcp.port == 25
eth.addr == 00:80:d3:24:52:c4 MAC address Filter
Filter by destination port tcp.dstport == 23
tcp.flag.reset == 1 RST flag filter
Filter by ip address and port ip.addr == 192.168.0.2 and Tcp.port == 25

Uses the same packet capturing options as the previous session, or uses
Jump forward in the packet history Go → Go forward Go Forward Start Capture → Start
defaults if no options were set
Go to specific packet Go → Go to Packet... Go to Packet... Stop Capture → Stop Stops currently active capture
Jump to first packet of the capture file Go → Go to First Packet Go to First Packet Restart Capture → Restart Restart active capture session
Jump to last packet of the capture file Go → Go to Last Packet Go to Last Packet Options... Capture → Options... Opens "Capture Options" dialog box
Auto scroll packet list during live capure View → Auto Scroll in Live Capture Auto Scroll in Live Capture Open... File → Open... Opens "File Open" dialog box to load a capture for viewing
Main Toolbar Items
Colorize the packet list (or not) View → Colorize Colorize Save as... File → Save as... Save current capture file
Zoom into the packet data (increase the font size) View → Zoom In Zoom In Close File → Close Close current capture file
Zoom out of the packet data (decrease the font size) View → Zoom Out Zoom Out Reload File → Reload Reload current capture file
Set zoom level back to 100% View → Normal Size Normal Size Find Packet... Edit → Find Packet... Find packet based on different criteria
Resize columns, so the content fits the width View → Resize Columns Resize Columns Go Back Go → Go back Jump back in the packet history

@hackinarticles https://in.linkedin.com/company/hackingarticles https://github.com/Ignitetechnologies