Wireshark Cheat Sheet Notes
Default Columns in a Packet Capture Output
- No.:
- Frame number from the beginging of the packet capture.
- Helps to identify the specific frame within the entire capture sequence.
- Time:
- Seconds from the first frame.
- Useful for understanding the timing and sequence of network events.
- Source (src).:
- Source address, commonly an IPv4, IPv6 or Ethernet address.
- Identifies the sender of the packet.
- Destination (dst).:
- Destination address.
- Indicates the recipient of the packet.
- Protocol:
- Protocol used in the Ethernet frame, IP packet, or TC segment.
- Examples include HTTP, TCP, UDP, etc.
- Length:
- Length of the frame in bytes.
- Important for analyzing the size of the data being transmitted.
Logical Operators
Operator | Description | Example |
---|
and && | Logical AND | All the conditions should match. |
or | | |
xor or AA | Logical XOR | Exclusive alterations only if the two conditions should match not both. |
not ! | Not (Negation) | Not equal to. |
[n....] | Substring operator | Filter a specific word or text. |
Filtering Packets (Display Filters)
Operator | Description | Example |
---|
eq or == | Logical AND | ip.dest == 192.168.1.1 |
ne or != | Logical OR | ip.dest != 192.168.1.1 |
xor or ^ | Logical XOR | frame.len ^ 10 |
gt or > | Greater operator | frame.len > 10 |
lt or < | Less operator | frame.len < 10 |
not or ! | Not (Negation) | |
ge or >= | Substring operator | frame.len >= 10 |
le or <= | Substring operator | frame.len <= 10 |
Filter Types
Filter Type | Description |
---|
Capture Filter | Filter packets during capture. |
Display Filter | Hide packets from a capture display. |
Wireshark Capturing Modes
- Promiscuous mode:
- Sets interface to capture all packets on a network segment to which it is associated.
- Helps in capturing all traffic regardless of destination.
- Monitor mode:
- Sets up the wireless interface to capture all traffic it can receive (Unix/Linux only).
- Useful for capturing wireless network traffic.
Capture Filter Syntax
- Syntax:
protocol Direction hosts value Logical operator Expressions
- Example:
tcp src 192.168.1.1 80 and tcp dst 202.164.30.1
- Allows the specification of conditions to capture only relevant packets.
Display Filter Syntax
- Syntax:
protocol String 1 String 1 Comparison operator Value Logical Operator Expressions
- Example:
http dest ip 192.168.1.1 and tcp.port
- Used to filter packets for display based on various criteria.
Keyboard Shortcuts - Main Display Window
Accelerator | Description |
---|
Tab or Shift+Tab | Move between screen elements, e.g., from the toolbars to the packet list. |
Tab or Shift+Tab | Move to the next packet or detail item. |
Tab or Shift+Tab | Move to the previous packet or detail item. |
Ctrl+ or F8 | Move to the next packet, even if the packet list isn't focused. |
Ctrl+< or F7 | Move to the previous packet, even if the packet list isn't focused. |
Ctrl+= | Move to the next packet of the conversation (TCP, UDP, or IP). |
Ctrl+- | Move to the previous packet of the conversation (TCP, UDP, or IP). |
Alt+or Optio | Move to the next packet within the selection history. |
Alt+Shift+ | In the packet detail, opens the selected tree item. |
Shift+< | In the packet detail, closes the selected tree item and all of its children. |
Ctrl+1 to Ctrl+4 | In the packet list, activates the 1st packet, the 2nd packet, etc. |
Shift+- | In the packet list, deactivates the next line. |
TAB | Move forward through items sequentially. |
Ctrl+< | In the packet detail, collapses the selected tree. |
Protocol Values
- Including but not limited to:
ether
fddi
ip
arp
rarp
decnet
lat
sca
moprc
mopdl
tcp
udp
Miscellaneous
- Slice Operator:
[...]
- Range of values.
- Membership Operator:
()
- In.
- CTRL+E: Start/Stop Capturing.
Remember, this cheat sheet summarises essential commands for efficient use and understanding of Wireshark, a powerful network protocol analyzer.
Reference: