Wireshark capture filter设置

常见语法

过滤器支持的函数：

过滤器的语言还有下面几个函数：
upper(string－field)－把字符串转换成大写
lower(string－field)－把字符串转换成小写

upper((和lower((在处理大小写敏感的字符串比较时很有用。例如：
upper(ncp.nds_stream_name) contains "MACRO"
lower(mount.dump.hostname) =="angel"

协议字段类型

每个协议的字段都有规定的类型。这些类型是：
unsigned integer               无符号整数（8比特、16比特、24比特、32比特）
signed integer                   有符号整数（8比特、16比特、24比特、32比特）
Boolean                             布尔值
Ethernet address               以太网地址（6字节）
Byte array                          字节数组
IPv4 address                      IPv4地址
IPv6 address                      IPv6地址
IPX network number           IPX网络地址
Text string                          文本串
Double-precision floating point number          双精度浮点值

三种进制表示方法：

frame.pkt_len>10
frame.pkt_len>012
frame.pkt_len>0xa

布尔值用1 0表示

以太网地址

eth.dst        eq        ff:ff:ff:ff:ff:ff
aim.data == 0.1.0.d
fddi.src == aa-aa-aa-aa-aa-aa
echo.data == 7a

ipv4和主机名

 ip.dst eq www.mit.edu 
 ip.src == 192.168.1.1

示例：

获取from或to ip 111.111.111.111

host 172.18.5.4

获取from或to ip 段

net 192.168.0.0/24 or net 192.168.0.0 mask 255.255.255.0

from ip段

src net 192.168.0.0/24  or src net 192.168.0.0 mask 255.255.255.0

to ip地址段

dst net 192.168.0.0/24 or dst net 192.168.0.0 mask 255.255.255.0

指定port数据

port 53    //53是dns

port段

(tcp[0:2] > 1500 and tcp[0:2] < 1550) or (tcp[2:2] > 1500 and tcp[2:2] < 1550)

或

tcp portrange 1501-1549

指定协议：如：Ethernet type EAPOL，ip

ether proto 0x888e
ip

目标地址不是某个ethernet

not ether dst 01:80:c2:00:00:0e

除去广播数据

not broadcast and not multicast

显示http 80 get数据

port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420   GET 16进制是0x474554

位过滤

IP Filters ip[0] & 0x0f low nibble: header length in 4octet words. should be 5 ip[1] type of service/QoS/DiffServ ip[2:2] total length of datagram in octets ip[4:2] IP ID number ip[6] & 0x80 reserved bit (possibly used for ECN) ip[6] & 0x40 DF bit ip[6] & 0x20 MF bit ip[6:2] & 0x1fff fragment offset (number of 8octet blocks) ip[8] ttl ip[9] protocol ip[10:2] header checksum ip[12:4] source IP ip[16:4] destination IP Samples   (ip[12:4] = ip[16:4]) Src IP = Dest IP (land attack) ip[0] & 0xf0 high nibble: IP version. almost always 4 (ip[0] & 0xf0 != 0x40) IP versions !=4 (ip[0:1] & 0x0f > 5) IP with options set (ip[19] = 0xff) Broadcasts to x.x.x.255 (ip[19] = 0x00) Broadcasts to x.x.x.0 (ip and ip[1] & 0xfc == 0xb8) search for EF in DSCP (ip and ip[1] & 0xfc == 0x28) search for AF11 in DSCP (ip and ip[1] & 0xfc != 0x00) search for DCSP Packets != 0 (ip[6] & 0x20 != 0) && (ip[6:2] & 0x1fff = 0) initial fragments (ip[6] & 0x20 != 0) && (ip[6:2] & 0x1fff != 0) intervening fragments (ip[6] & 0x20 = 0) && (ip[6:2] & 0x1fff != 0) terminal fragments (ip[0] & 0x0f) != 5 has ip options (or is truncated, or is just some sort of freak...) ip[8] < 5 short TTL value ip[6] = 32 MF set iip[2:2] > 999 IP Packet greater then 999

ICMP Filters icmp[0] type icmp[1] code icmp[2:2] checksum Samples   icmp[0]=0x# all Packets with ICMP Type icmp[0]=0x# and icmp[1]=0x# all Packets with ICMP Type X and Code = Y icmp[0]=8 ICMP Request Messages icmp[8]=0 ICMP Request Replay icmp[0]=0x11 ICMP Address Mask Request icmp[0]=0x12 ICMP Address Mask Replay icmp[0]=11 and icmp[1]=0 ICMP Time Exeedet icmp[0]=3 and icmp[1]=4 ICMP Time Exeedet icmp[0]=8 and ip[2:2] > 64 Large ICMP Packets

TCP Filters tcp[0:2] source port tcp[2:2] destination port tcp[4:4] sequence number tcp[8:4] ack number tcp[12] header length tcp[13] tcp flags   ---- --S- 0000 0010 = 0x02 normal syn   ---A --S- 0001 0010 = 0x12 normal syn-ack   ---A ---- 0001 0000 = 0x10 normal ack   --UA P--- 0011 1000 = 0x38 psh-urg-ack. interactive stuff like ssh   ---A -R-- 0001 0100 = 0x14 rst-ack. it happens.   ---- --SF 0000 0011 = 0x03 syn-fin scan   --U- P--F 0010 1001 = 0x29 urg-psh-fin. nmap fingerprint packet   -Y-- ---- 0100 0000 = 0x40 anything >= 0x40 has a reserved bit set   XY-- ---- 1100 0000 = 0xC0 both reserved bits set   XYUA PRSF 1111 1111 = 0xFF FULL_XMAS scan tcp[14:2] window size tcp[16:2] checksumt tcp[18:2] urgent pointer Samples   tcp[13] = 0x02 is SYN. nothing else. (tcp[13] & 0x02) != 0 contains SYN. we don't care what else... (tcp[13] & 0x03) = 3 is some kind of SYN-FIN. realy Bad   winnuke (not tested) tcp[20:4] = 0x47455420 GET in request

UDP Filters udp[0:2] source port udp[2:2] destination port udp[4:2] datagram length udp[6:2] UDP checksum

protocols ip[9] == 8 EGP ip[9] == 9 IGP ip[9] == 88 EIRGP ip[9] == 50 ESP ip[9] == 51 AH ip[9] == 89 OSPF ip[9] == 124 ISIS   other, see /etc/protocols

Routing Protocols (udp and port 520) or (host 224.0.0.9) RIP 1 + 2 tcp and port 179 BGP ip[9] == 8 EGP ip[9] == 9 IGP ip[9] == 88 EIRGP ip[9] == 89 OSPF ip[9] == 124 ISIS

ether Filters ether[20:2] == 0x2000 CDP pakets ether[12:2] == 0x0806 ARP pakets

IPv6 ip6 filters native IPv6 traffic (including ICMPv6) icmp6 filters native ICMPv6 traffic proto ipv6 filters tunneled IPv6-in-IPv4 traffic TCP   ip6 and (ip6[6] == 0x06) IPv6 TCP ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x02) IPv6 TCP Syn ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x10) IPv6 TCP ACK ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x12) IPv6 TCP Syn/ACK UDP   ip6 and (ip6[6] == 0x11) IPv6 TCP ICMP   (ip6[6] == 0x3a) ICMP v6 (ip6[6] == 0x3a) and (ip6[40] == 0x01) ipv6 and type 1 Dest Unreachable (ip6[6] == 0x3a) and (ip6[40] == 0x02) ipv6 and type 2 Packet too big (ip6[6] == 0x3a) and (ip6[40] == 0x03) ipv6 and type 3 Time Exeedet (ip6[6] == 0x3a) and (ip6[40] == 0x04) ipv6 and type 4 Parameter Problem (ip6[6] == 0x3a) and (ip6[40] == 0x80) ipv6 and type 128 Echo Request (ip6[6] == 0x3a) and (ip6[40] == 0x81) ipv6 and type 129 Echo Reply (ip6[6] == 0x3a) and (ip6[40] == 0x86) ipv6 and type 133 Router Solicitation (ip6[6] == 0x3a) and (ip6[40] == 0x87) ipv6 and type 134 Router Advertisement (ip6[6] == 0x3a) and (ip6[40] == 0x88) ipv6 and type 135 Neighbor Solicitation (ip6[6] == 0x3a) and (ip6[40] == 0x89) ipv6 and type 136 Neighbor Advertisement

MY Filters tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224' IP broadcast or multicast packets that were not sent via ethernet broadcast or multicast: