Skip to content

Introduction to Wireshark – Part 2

Welcome to my second part of “Introduction to Wireshark”

I am happy to see you back here.

In the first part we started to get a first overview about Wireshark and how to start capturing traffic.

Following article will show some of the most needed capture and display filter.
In addition I will show you some basic statistics to get a first overview about your tcpdump.

Time to read:

  • 5 min

Target Group

  • Beginner’s Level

Content

  1. Filter Syntax
  2. Statistics: Capture File Properties
  3. Statistics: Protocol Hierarchy & Conversations

Filter Syntax (Updated: 21.12.2017)

The table below shows the filters you need to set for your specific goals.
It is very cool to be able to use the “or / and” operators also in the filter section.

DescriptionCapture FilterDisplay Filter
Filter for 1 IP Addresshost 173.212.216.192ip.addr==173.212.216.192
Filter for more than 1 IP Addresshost 173.212.216.192 or host 173.212.216.193ip.addr==173.212.216.192 or ip.addr==173.212.216.193
Filter for 1 TCP Porttcp port 443tcp.port==443
Filter for 1 IP Address and 1 TCP Porthost 173.212.216.192 and tcp port 443ip.addr==173.212.216.192 and tcp.port==443
Filter to show retransmissionstcp.analysis.retransmission

 

Statistics: Capture File Properties

The first step I usually do when I open a tcpdump in Wireshark is to open the “Capture File Properties”.

It will show details like:

  • Start + End Time of the Trace.
  • Duration.
  • Interface statistics.
  • Statistics (Number of Packets, Average pps, Average packet size, Bytes, Average bytes/s, Average bits/s).

To open it click on the “Statistic” tab and select the first choice “Capture File Properties”.

Introduction to Wireshark

Statistics: Protocol Hierarchy & Conversations

An important step is to get an overview about the captured protocols and TCP conversations.

The “Protocol Hierarchy” gives you a statistic which shows how many packets / bytes / bits are sent by Protocol.
To open it click on the “Statistic” tab and select “Protocol Hierarchy”.

Introduction to Wireshark

The “Conversations” statistic give you the same information by conversation for the “Ethernet, IPv4, IPv4, TCP, UDP” layer.
To open it click on the “Statistic” tab and select “Conversations”.

Introduction to Wireshark

Summary

My feeling is that the topics covered in this article should give a first introduction to Wireshark filters and statistics. You can already see how powerful Wireshark is.

In my next articles I will cover more about the analysis of specific use cases.

If you want to know more about the Wireshark basics, join my Slack Workspace or send me an email.
Stay up-to-date and subscribe to my Newsletter!

Published inWireshark

3 Comments

  1. […] Tcpdump command allows you to set a “capture filter” to be able to save only packets which are interested for you. You want to get a first feeling about capture filter, refer to Introduction to Wireshark – Part 2. […]

Leave a Reply

Your email address will not be published. Required fields are marked *

Please wait...

Subscribe to my newsletter

Want to be updated when a new article is published? Enter your email address and name below to be the first to know.