BPF (Berkeley Packet Filter) uses natural language syntax is similar to the use of specific grammatical construction string determine the retention of data packets conform to the rules while ignoring other data packets.
Grammar rules: type represents an object, such as IP address, subnet or port host, net, port
dir indicates the direction of packet transmission src, dst
proto represents the packet that matches the protocol type ether, ip, tcp, arp
E.g:
ip.addr == IP address
ip.src = IP address, network segment
ip.dst = IP address
dst port 80 indicates the target address information 80 port
tcp.port udp.port 1 shows a specific end
and an expression that represents both the connection requires the establishment of
wireshark packet filter: filter and filter capture filter
Capture Filters: Filters Berkeley follow the rules of grammar. Only capture the target port is a TCP packet 80
Only capture data packets TCP destination port 80, tcp dst port 80
Host IP address of 192.168.4.5 capture packets, host 192.168.4.5
Note: For the host does not support CIDR written, and written directly hostname
Input box indicates an error in red, and green filters can be executed correctly
Filter Filters:
Display filters are created:
- Packet details panel to create
- Input box to create
Expression rules:
1. The values relating to operator + +
2. and NOR logic: logic AND-OR (&& ||!)
Wireshark capture to save the file:
1. Set the output format: pcap-ng and pcap.
2. Output File Location: Click Browse to save the file of the data stream is particularly large, it will lead to pieces too large, resulting wireshark can not open the saved file properly. Solution: Set a new file is created automatically create a file every 10 seconds.
3. Use wireshark network monitoring, no matter how much hard disk space are likely to be exhausted. Solution: a ring buffer. Save the equivalent of a fixed number of packets a day, the next day when deleted directly in front of the packet.
4. Capture Options: Show options to resolve the name, automatically stop the capture.
5. Save Settings file.
