[学习]WireShark 的过滤功能

1. 打开 wireShark 过滤显示 协议

比如显示arp协议

过滤栏输入arp即可

支持的协议类型

TCP

UDP

HTTP

FTP

ICMP

SMTP
等等

2. 过滤ip地址

ip.addr eq 10.24.13.6

or

ip.addr == 10.24.13.6

或者是区分 源地址或者是目标地址

ip.src == 10.24.13.6

或者目标地址

ip.dst eq  10.24.13.6

3. 过滤端口 以及增加 and 条件等.

tcp.port ==  || ip.src eq 10.24.13.97

4. mac地址过滤

eth.dst

eth.src

eth.addr 

5. http 方法过滤

http.request.method == "GET"

http.request.method == "POST"

http.request.uri == "/img/logo-edu.gif"

http contains "GET"

http contains "HTTP/1."

// GET包

http.request.method == "GET" && http contains "Host: "

http.request.method == "GET" && http contains "User-Agent: "

// POST包

http.request.method == "POST" && http contains "Host: "

http.request.method == "POST" && http contains "User-Agent: "

// 响应包

http contains "HTTP/1.1 200 OK" && http contains "Content-Type: "

http contains "HTTP/1.0 200 OK" && http contains "Content-Type: "