Wireshark capture filter设置

常见语法

过滤器支持的函数：

过滤器的语言还有下面几个函数：
upper(string－field)－把字符串转换成大写
lower(string－field)－把字符串转换成小写

upper((和lower((在处理大小写敏感的字符串比较时很有用。例如：
upper(ncp.nds_stream_name) contains "MACRO"
lower(mount.dump.hostname) =="angel"

协议字段类型

每个协议的字段都有规定的类型。这些类型是：
unsigned integer               无符号整数（8比特、16比特、24比特、32比特）
signed integer                   有符号整数（8比特、16比特、24比特、32比特）
Boolean                             布尔值
Ethernet address               以太网地址（6字节）
Byte array                          字节数组
IPv4 address                      IPv4地址
IPv6 address                      IPv6地址
IPX network number           IPX网络地址
Text string                          文本串
Double-precision floating point number          双精度浮点值

三种进制表示方法：

frame.pkt_len>10
frame.pkt_len>012
frame.pkt_len>0xa

布尔值用1 0表示

以太网地址

eth.dst        eq        ff:ff:ff:ff:ff:ff
aim.data == 0.1.0.d
fddi.src == aa-aa-aa-aa-aa-aa
echo.data == 7a

ipv4和主机名

 ip.dst eq www.mit.edu 
 ip.src == 192.168.1.1

示例：

获取from或to ip 111.111.111.111

host 172.18.5.4

获取from或to ip 段

net 192.168.0.0/24 or net 192.168.0.0 mask 255.255.255.0

from ip段

src net 192.168.0.0/24  or src net 192.168.0.0 mask 255.255.255.0

to ip地址段

dst net 192.168.0.0/24 or dst net 192.168.0.0 mask 255.255.255.0

指定port数据

port 53    //53是dns

port段

(tcp[0:2] > 1500 and tcp[0:2] < 1550) or (tcp[2:2] > 1500 and tcp[2:2] < 1550)

或

tcp portrange 1501-1549

指定协议：如：Ethernet type EAPOL，ip

ether proto 0x888e
ip

目标地址不是某个ethernet

not ether dst 01:80:c2:00:00:0e

除去广播数据

not broadcast and not multicast

显示http 80 get数据

port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420   GET 16进制是0x474554

位过滤

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
IP Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
ip[0] & 0x0f
 
             
low nibble: header length in 4octet words. should be 5
 
            
 
            
 
             
ip[1]
 
             
type of service/QoS/DiffServ
 
            
 
            
 
             
ip[2:2]
 
             
total length of datagram in octets
 
            
 
            
 
             
ip[4:2]
 
             
IP ID number
 
            
 
            
 
             
ip[6] & 0x80
 
             
reserved bit (possibly used for ECN)
 
            
 
            
 
             
ip[6] & 0x40
 
             
DF bit
 
            
 
            
 
             
ip[6] & 0x20
 
             
MF bit
 
            
 
            
 
             
ip[6:2] & 0x1fff
 
             
fragment offset (number of 8octet blocks)
 
            
 
            
 
             
ip[8]
 
             
ttl
 
            
 
            
 
             
ip[9]
 
             
protocol
 
            
 
            
 
             
ip[10:2]
 
             
header checksum
 
            
 
            
 
             
ip[12:4]
 
             
source IP
 
            
 
            
 
             
ip[16:4]
 
             
destination IP
 
            
 
            
 
             
Samples
 
             
 
 
            
 
            
 
             
(ip[12:4] = ip[16:4])
 
             
Src IP = Dest IP (land attack)
 
            
 
            
 
             
ip[0] & 0xf0
 
             
high nibble: IP version. almost always 4
 
            
 
            
 
             
(ip[0] & 0xf0 != 0x40)
 
             
IP versions !=4
 
            
 
            
 
             
(ip[0:1] & 0x0f > 5)
 
             
IP with options set
 
            
 
            
 
             
(ip[19] = 0xff)
 
             
Broadcasts to x.x.x.255
 
            
 
            
 
             
(ip[19] = 0x00)
 
             
Broadcasts to x.x.x.0
 
            
 
            
 
             
(ip and ip[1] & 0xfc == 0xb8)
 
             
search for EF in DSCP
 
            
 
            
 
             
(ip and ip[1] & 0xfc == 0x28)
 
             
search for AF11 in DSCP
 
            
 
            
 
             
(ip and ip[1] & 0xfc != 0x00)
 
             
search for DCSP Packets != 0
 
            
 
            
 
             
(ip[6] & 0x20 != 0) && (ip[6:2] & 0x1fff = 0)
 
             
initial fragments
 
            
 
            
 
             
(ip[6] & 0x20 != 0) && (ip[6:2] & 0x1fff != 0)
 
             
intervening fragments
 
            
 
            
 
             
(ip[6] & 0x20 = 0) && (ip[6:2] & 0x1fff != 0)
 
             
terminal fragments
 
            
 
            
 
             
(ip[0] & 0x0f) != 5
 
             
has ip options (or is truncated, or is just some sort of freak...)
 
            
 
            
 
             
ip[8] < 5
 
             
short TTL value
 
            
 
            
 
             
ip[6] = 32
 
             
MF set
 
            
 
            
 
             
iip[2:2] > 999
 
             
IP Packet greater then 999
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
ICMP Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
icmp[0]
 
             
type
 
            
 
            
 
             
icmp[1]
 
             
code
 
            
 
            
 
             
icmp[2:2]
 
             
checksum
 
            
 
            
 
             
Samples
 
             
 
 
            
 
            
 
             
icmp[0]=0x#
 
             
all Packets with ICMP Type
 
            
 
            
 
             
icmp[0]=0x# and icmp[1]=0x#
 
             
all Packets with ICMP Type X and Code = Y
 
            
 
            
 
             
icmp[0]=8
 
             
ICMP Request Messages
 
            
 
            
 
             
icmp[8]=0
 
             
ICMP Request Replay
 
            
 
            
 
             
icmp[0]=0x11
 
             
ICMP Address Mask Request
 
            
 
            
 
             
icmp[0]=0x12
 
             
ICMP Address Mask Replay
 
            
 
            
 
             
icmp[0]=11 and icmp[1]=0
 
             
ICMP Time Exeedet
 
            
 
            
 
             
icmp[0]=3 and icmp[1]=4
 
             
ICMP Time Exeedet
 
            
 
            
 
             
icmp[0]=8 and ip[2:2] > 64
 
             
Large ICMP Packets
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
TCP Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
tcp[0:2]
 
             
source port
 
            
 
            
 
             
tcp[2:2]
 
             
destination port
 
            
 
            
 
             
tcp[4:4]
 
             
sequence number
 
            
 
            
 
             
tcp[8:4]
 
             
ack number
 
            
 
            
 
             
tcp[12]
 
             
header length
 
            
 
            
 
             
tcp[13]
 
             
tcp flags
 
            
 
            
 
             
 
 
             
---- --S-       0000 0010 = 0x02   normal syn
 
            
 
            
 
             
 
 
             
---A --S-       0001 0010 = 0x12   normal syn-ack
 
            
 
            
 
             
 
 
             
---A ----       0001 0000 = 0x10   normal ack
 
            
 
            
 
             
 
 
             
--UA P---       0011 1000 = 0x38   psh-urg-ack. interactive stuff like ssh
 
            
 
            
 
             
 
 
             
---A -R--       0001 0100 = 0x14   rst-ack. it happens.
 
            
 
            
 
             
 
 
             
---- --SF       0000 0011 = 0x03   syn-fin scan
 
            
 
            
 
             
 
 
             
--U- P--F       0010 1001 = 0x29   urg-psh-fin. nmap fingerprint packet
 
            
 
            
 
             
 
 
             
-Y-- ----       0100 0000 = 0x40   anything >= 0x40 has a reserved bit set
 
            
 
            
 
             
 
 
             
XY-- ----       1100 0000 = 0xC0   both reserved bits set
 
            
 
            
 
             
 
 
             
XYUA PRSF       1111 1111 = 0xFF   FULL_XMAS scan
 
            
 
            
 
             
tcp[14:2]
 
             
window size
 
            
 
            
 
             
tcp[16:2]
 
             
checksumt
 
            
 
            
 
             
tcp[18:2]
 
             
urgent pointer
 
            
 
            
 
             
Samples
 
             
 
 
            
 
            
 
             
tcp[13] = 0x02
 
             
is SYN. nothing else.
 
            
 
            
 
             
(tcp[13] & 0x02) != 0
 
             
contains SYN. we don't care what else...
 
            
 
            
 
             
(tcp[13] & 0x03) = 3
 
             
is some kind of SYN-FIN. realy Bad
 
            
 
            
 
             
 
 
             
winnuke (not tested)
 
            
 
            
 
             
tcp[20:4] = 0x47455420
 
             
GET in request
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
UDP Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
udp[0:2]
 
             
source port
 
            
 
            
 
             
udp[2:2]
 
             
destination port
 
            
 
            
 
             
udp[4:2]
 
             
datagram length
 
            
 
            
 
             
udp[6:2]
 
             
UDP checksum
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
protocols
 
        
 
        
 
         
 
          
 
           
 
            
 
             
ip[9] == 8
 
             
EGP
 
            
 
            
 
             
ip[9] == 9
 
             
IGP
 
            
 
            
 
             
ip[9] == 88
 
             
EIRGP
 
            
 
            
 
             
ip[9] == 50
 
             
ESP
 
            
 
            
 
             
ip[9] == 51
 
             
AH
 
            
 
            
 
             
ip[9] == 89
 
             
OSPF
 
            
 
            
 
             
ip[9] == 124
 
             
ISIS
 
            
 
            
 
             
 
 
             
other, see /etc/protocols
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
Routing Protocols
 
        
 
        
 
         
 
          
 
           
 
            
 
             
(udp and port 520) or (host 224.0.0.9)
 
             
RIP 1 + 2
 
            
 
            
 
             
tcp and port 179
 
             
BGP
 
            
 
            
 
             
ip[9] == 8
 
             
EGP
 
            
 
            
 
             
ip[9] == 9
 
             
IGP
 
            
 
            
 
             
ip[9] == 88
 
             
EIRGP
 
            
 
            
 
             
ip[9] == 89
 
             
OSPF
 
            
 
            
 
             
ip[9] == 124
 
             
ISIS
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
ether Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
ether[20:2] == 0x2000
 
             
CDP pakets
 
            
 
            
 
             
ether[12:2] == 0x0806
 
             
ARP pakets
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
IPv6
 
        
 
        
 
         
 
          
 
           
 
            
 
             
ip6
 
             
filters native IPv6 traffic (including ICMPv6)
 
            
 
            
 
             
icmp6
 
             
filters native ICMPv6 traffic
 
            
 
            
 
             
proto ipv6
 
             
filters tunneled IPv6-in-IPv4 traffic
 
            
 
            
 
             
TCP
 
             
 
 
            
 
            
 
             
ip6 and (ip6[6] == 0x06)
 
             
IPv6 TCP
 
            
 
            
 
             
ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x02)
 
             
IPv6 TCP Syn
 
            
 
            
 
             
ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x10)
 
             
IPv6 TCP ACK
 
            
 
            
 
             
ip6 and (ip6[6] == 0x06) and (ip6[53] == 0x12)
 
             
IPv6 TCP Syn/ACK
 
            
 
            
 
             
UDP
 
             
 
 
            
 
            
 
             
ip6 and (ip6[6] == 0x11)
 
             
IPv6 TCP
 
            
 
            
 
             
ICMP
 
             
 
 
            
 
            
 
             
(ip6[6] == 0x3a)
 
             
ICMP v6
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x01)
 
             
ipv6 and type 1 Dest Unreachable
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x02)
 
             
ipv6 and type 2 Packet too big
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x03)
 
             
ipv6 and type 3 Time Exeedet
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x04)
 
             
ipv6 and type 4 Parameter Problem
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x80)
 
             
ipv6 and type 128 Echo Request
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x81)
 
             
ipv6 and type 129 Echo Reply
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x86)
 
             
ipv6 and type 133 Router Solicitation
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x87)
 
             
ipv6 and type 134 Router Advertisement
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x88)
 
             
ipv6 and type 135 Neighbor Solicitation
 
            
 
            
 
             
(ip6[6] == 0x3a) and (ip6[40] == 0x89)
 
             
ipv6 and type 136 Neighbor Advertisement
 
            
 
           
 
          
 
        
 
       
 
      
 
    
 
   
  
  
  
  

  
  
  
  

   
   
   
   
 
    
 
     
 
      
 
       
 
        
 
         
MY Filters
 
        
 
        
 
         
 
          
 
           
 
            
 
             
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
 
             
IP broadcast or multicast packets that were not sent via ethernet broadcast or multicast: