Top 10 Wireshark Filters (Chris Greer)

 

The filtering capabilities of Wireshark are very comprehensive. You can filter on just about any field of any protocol, even down to the HEX values in a data stream. Sometimes though, the hardest part about setting a filter in Wireshark is remembering the syntax.

So below are the most common filters that I use in Wireshark. Please comment below and add any common ones that you use as well.

ip.addr == 10.0.0.1
[Sets a filter for any packet with 10.0.0.1, as either the source or dest]

ip.addr==10.0.0.1 && ip.addr==10.0.0.2

[sets a conversation filter between the two defined IP addresses]

tcp.time_delta > .250

[sets a filter to display all tcp packets that have a delta time of greater than 250mSec in the context of their stream. Note, this filter requires TCP Conversation Timestamps to be calculated. To learn to do that, click here.]

tcp.port==4000

[sets a filter for any TCP packet with 4000 as a source or dest port]

tcp.flags == 0x012

[displays all TCP SYN/ACK packets - shows the connections that had a positive response. Related to this is tcp.flags.syn==1]

ip.addr == 10.0.0.0/24

[Shows packets to and from any address in the 10.0.0.0/24 space]

frame contains traffic
[displays all packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID]

!(arp or icmp or stp)
[masks out arp, icmp, stp, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest]

eth[0x47:2] == 01:80 [This is an example of an offset filter. It sets a filter for the HEX values of 0x01 and 0x80 specifically at the offset location of 0x47]

tcp.analysis.flags && !tcp.analysis.window_update

[displays all retransmissions, duplicate acks, zero windows, and more in the trace. Helps when tracking down slow application performance and packet loss. It will not include the window updates, since these aren't really important for me to see in most cases.]

So there are a few of my favorite Wireshark filters. There are a ton more that I use, but these are the big ones. How about you? What are your most commonly used filters?

Here is a video showing how to set these filters.

Crossing the 10 Million Mark: DDoS Attacks in 2020 ( Richard Hummel, Carol Hildebrandon)

DDoS Attacks in 2020

Not all world records are cause for celebration—just look at the DDoS attack numbers from 2020. For the first time in history, we observed more than 10 million DDoS attacks in a single year, with NETSCOUT’s ATLAS Security Engineering and Response Team (ASERT) observing 10,089,687 attacks over the course of the year. That’s nearly 1.6 million more attacks than 2019’s count of 8.5 million.

Granted, DDoS attack numbers move only in one direction—up. But context is important when looking at DDoS statistics from 2020. From March until the end of the year, DDoS attackers operated amidst the COVID-19 pandemic. While most of the world saw an unprecedented global health crisis, malicious actors saw new vulnerabilities and opportunity. It is seldom that annual activity is so deeply affected by one event, but such is the case with 2020 DDoS attack activity and trends. It is no coincidence that this milestone number of global attacks comes at a time when businesses have relied so heavily on online services to survive.

The start of the pandemic lockdown ushered in a “new normal” in the way we live a......

To read the full article, click on the link below

https://www.netscout.com/blog/asert/crossing-10-million-mark-ddos-attacks-2020

A Quick Note About TCP Sequence Numbers

I’ve received a lot of feedback from my readers expressing their gratitude that my articles/videos are short and to the point. To those people who took the time to send their feedback, thank you.

One topic that I’ve been asked to cover lately is TCP sequence number analysis. There are many videos out there that are very good. I know, since I watched quite a few of them ;)

After watching 4 or 5 of these videos, I noticed that they weren’t geared towards analysts getting into this level of analysis for the first time and missed a few items that I would have added. So here you go.

In this video I briefly’ cover some of the TCP sequence tips and tricks that I use in the field. The important part is to remember that by default Wireshark will display the relative sequence number. It even displays that note in the detail (middle) pane. You can easily toggle this on and off by right clicking on the TCP sequence number (or anywhere in the TCP header), select Protocol Preferences and check/uncheck Relative Sequence numbers.

I also briefly mention that you can also use the netstat –s command from the command prompt to track lost packets by looking at the TCP Segments Retransmitted counter.

The point of the video is to provide a simple introduction so the whole process of TCP analysis becomes a bit more straightforward.

Our Curious Habits (Paul Smith)

 

As an engineer, I’m often accused by my non-engineer brethren of being overly analytical. I confess that I can’t help scrutinizing some things (well...most things) to try and figure out how they work. This can lead to satisfaction and a boost in self-assurance when things work as expected, and a compulsive drive for further analysis when they don’t. I have been blessed (cursed?) with this inclination for as long as I can remember. I have been formally trained for it in school and throughout my career. Reinforced by a lifetime of use, this habit is unlikely to ever change.

Wireshark Display Filter Tip: Show Specific Frame Numbers

 

Wireshark’s features can really be a catch 22. In one way, they are very powerful but on another hand, many of them are difficult to find. Every so often I find a gem of a tip or trick which makes packet analysis a lot easier.

In this video I share a different kind of display filter that you may not be familiar with. I’m sure you have used MAC, IP address, TCP, UDP and maybe even some application layer display filters. I find that sometimes I need to display just a few packets that might not have MAC, IP, TCP or UDP port numbers in common.

As you will see in the video, one way to address this challenge is to simply Mark the packets and then apply a display filter for just marked packets. The other way is to use the following display filter syntax frame.number in {frame numbers} this will simply display any frame number you provide in the curly braces.

By focusing on a lesser‑known display filter, I demonstrate how to cut through noisy captures and quickly zero in on the traffic you actually need to inspect.