Hello everyone, nice to see you again. I am your friend Quanzhanjun.
Wireshark provides two kinds of filters:
Capture filter: Set the filter conditions before capturing packets, and then only capture the packets that meet the conditions.
Display filter: Set filter conditions in the captured packet set to hide packets that you do not want to display and only display packets that meet the conditions.
It should be noted that the syntax used by these two filters is completely different. Just think about it and you will know that it is not Wireshark but WinPcap that captures the network card data. Of course, it must follow the rules of WinPcap. The display filter is Wiresharkâs screening of the captured data.
The main reason to use capture filters is performance. If you know that you donât need to analyze a certain type of traffic, you can simply filter it out with a capture filter, saving processor resources that would otherwise be used to capture those packets. Using capture filters is particularly useful when processing large amounts of data.
The initial interface of the new version of Wireshark is very simple, and it mainly provides two functions: first set the capture filter, and then select the network card responsible for packet capture. This shows the importance of capture filters.
Wireshark intercepts all data accessed through the network card without setting any proxy
Wireshark cannot intercept local loopback access requests, i.e. 127.0.0.1 or localhost
Display Filters:
The following is the interception of http requests in Wireshark. Note that https is not included.
http.request.uri contains âproductâ
Requests that contain product in the link address, not including the domain name
http.host==shanghai.rongzi.com
Filter Domain Names
http.host contains rongzi.com
More fuzzy filtering, can have multiple second-level domain names
http.content_type ==âtext/htmlâ
content_type type filtering
http.request.uri==â/product/â
Complete address filtering, if there are parameters, it is not suitable to filter like this
http.request.method==âGETâ
tcp.port==80
http && tcp.port==8613 or tcp.port==8090 or tcp.port==8091
ip.dst==42.159.245.203
collect:
http.host==magentonotes.com
http.host contains magentonotes.com//Filters the http data packets passing through the specified domain name. The host value here is not necessarily the domain name in the request
http.response.code==302
//Filter packets with http response status code 302
http.response==1
//Filter all http response packets
http.request==1
//Filter all http requests, it seems that you can also use http.request
http.request.method==POST//Wireshark filters all http request packets whose request method is POST. Note that POST is capitalized.
http.cookie contains guid //Filters the http packets containing the specified cookie
http.request.uri==â/online/setpointâ //Filter the request URI, the value is the part after the domain name
http.request.full_uri==âhttp://task.browser.360.cn/online/setpointâ//To filter the entire URL including the domain name, you need to use http.request.full_uri
http.server contains ânginxâ //Filter packets containing the character nginx in the server field of the http header
http.content_type== âtext/htmlâ //Filters HTTP responses and post packets whose content_type is text/html, that is, filters HTTP packets based on file type
http.content_encoding==âgzipâ //Filter http packets whose content_encoding is gzip
http.transfer_encoding==âchunkedâ //Filter according to transfer_encoding
http.content_length== 279http.content_length_header== â279âł//Filter based on the value of content_length
http.server//Filter all packets containing the server field in the http header
http.request.version== âHTTP/1.1â //Filter HTTP/1.1 version http packets, including requests and responses
http.response.phrase==âOKâ //Filter phrase in http response
Snap Filters:
Capture â> Capture Filter
Capture â> Options â>
Click Start to begin capturing data.
Through testing, it is found that the above use case uses the domain name, but the actual use is the IP, because many different domain names, but the data of the same IP can also be captured!
For specific rules, please see the link below, which contains many examples.
Wireshark captures mysql statements:
mysql.query contains âSELECTâ
All mysql statement contents are filtered:
mysql contains âFD171290339530899459â
Filter data in tcp
tcp.payload contains âsendAppPushMsgâ
Publisher: Full-stack Programmer Stack Leader, please indicate the source for reprinting: https://javaforall.cn/158474.html Original link: https://javaforall.cn