Wireshark Cheat Sheet: Capture, Filter, and Shortcuts Guide

Wireshark Cheat Sheet: Capture, Filter, and Shortcuts Guide

Wireshark Cheat Sheet Notes

IMG_0166.jpeg

Default Columns in a Packet Capture Output

  • No.:
    • Frame number from the beginging of the packet capture.
    • Helps to identify the specific frame within the entire capture sequence.
  • Time:
    • Seconds from the first frame.
    • Useful for understanding the timing and sequence of network events.
  • Source (src).:
    • Source address, commonly an IPv4, IPv6 or Ethernet address.
    • Identifies the sender of the packet.
  • Destination (dst).:
    • Destination address.
    • Indicates the recipient of the packet.
  • Protocol:
    • Protocol used in the Ethernet frame, IP packet, or TC segment.
    • Examples include HTTP, TCP, UDP, etc.
  • Length:
    • Length of the frame in bytes.
    • Important for analyzing the size of the data being transmitted.

Logical Operators

OperatorDescriptionExample
and &&Logical ANDAll the conditions should match.
or
xor or AALogical XORExclusive alterations only if the two conditions should match not both.
not !Not (Negation)Not equal to.
[n....]Substring operatorFilter a specific word or text.

Filtering Packets (Display Filters)

OperatorDescriptionExample
eq or ==Logical ANDip.dest == 192.168.1.1
ne or !=Logical ORip.dest != 192.168.1.1
xor or ^Logical XORframe.len ^ 10
gt or >Greater operatorframe.len > 10
lt or <Less operatorframe.len < 10
not or !Not (Negation)
ge or >=Substring operatorframe.len >= 10
le or <=Substring operatorframe.len <= 10

Filter Types

Filter TypeDescription
Capture FilterFilter packets during capture.
Display FilterHide packets from a capture display.

Wireshark Capturing Modes

  • Promiscuous mode:
    • Sets interface to capture all packets on a network segment to which it is associated.
    • Helps in capturing all traffic regardless of destination.
  • Monitor mode:
    • Sets up the wireless interface to capture all traffic it can receive (Unix/Linux only).
    • Useful for capturing wireless network traffic.

Capture Filter Syntax

  • Syntax: protocol Direction hosts value Logical operator Expressions
  • Example: tcp src 192.168.1.1 80 and tcp dst 202.164.30.1
  • Allows the specification of conditions to capture only relevant packets.

Display Filter Syntax

  • Syntax: protocol String 1 String 1 Comparison operator Value Logical Operator Expressions
  • Example: http dest ip 192.168.1.1 and tcp.port
  • Used to filter packets for display based on various criteria.

Keyboard Shortcuts - Main Display Window

AcceleratorDescription
Tab or Shift+TabMove between screen elements, e.g., from the toolbars to the packet list.
Tab or Shift+TabMove to the next packet or detail item.
Tab or Shift+TabMove to the previous packet or detail item.
Ctrl+ or F8Move to the next packet, even if the packet list isn't focused.
Ctrl+< or F7Move to the previous packet, even if the packet list isn't focused.
Ctrl+=Move to the next packet of the conversation (TCP, UDP, or IP).
Ctrl+-Move to the previous packet of the conversation (TCP, UDP, or IP).
Alt+or OptioMove to the next packet within the selection history.
Alt+Shift+In the packet detail, opens the selected tree item.
Shift+<In the packet detail, closes the selected tree item and all of its children.
Ctrl+1 to Ctrl+4In the packet list, activates the 1st packet, the 2nd packet, etc.
Shift+-In the packet list, deactivates the next line.
TABMove forward through items sequentially.
Ctrl+<In the packet detail, collapses the selected tree.

Protocol Values

  • Including but not limited to:
    • ether
    • fddi
    • ip
    • arp
    • rarp
    • decnet
    • lat
    • sca
    • moprc
    • mopdl
    • tcp
    • udp

Miscellaneous

  • Slice Operator: [...] - Range of values.
  • Membership Operator: () - In.
  • CTRL+E: Start/Stop Capturing.

Remember, this cheat sheet summarises essential commands for efficient use and understanding of Wireshark, a powerful network protocol analyzer.

Reference: