information gathering – wireshark

Wireshark - the worlds foremost network protocol analyzer

Backtrack 5R1

root@bt:~# wireshark

1. Interface List / Start capture on interface: = eth0

ip.src = IP source address
ip.dst = IP destination address

Filter:

To filter on a single host
ip.src == 192.168.1.2

To filter on a network
ip.src == 192.168.1.0/24

To filter a single host - single destination
(ip.src == 192.168.1.2) && (ip.dst == 192.168.25.4)

To filter on a single port/service
tcp.port eq 80

To filter on mutiple port/services
(tcp.port eq 443) or (tcp.port eq 80)

To filter for ICMP
icmp

To filter out ICMP
!icmp

To filter on a single host - single destination - using a single port
(ip.src == 192.168.1.2) && (ip.dst == 192.168.25.4) && tcp.port eq 80

To filter on a single host - single destination - Filter on Windows -- Filter out noise, while watching Windows Client - DC exchanges
(ip.src == 192.168.1.2) && (ip.dst == 192.168.25.4) && smb || nbns || dcerpc || nbss || dns

Filter on Windows -- Filter out noise, while watching Windows Client - DC exchanges
smb || nbns || dcerpc || nbss || dns

Leave a comment