Wireshark Filter Syntax for IP Address Matching

Wireshark, a popular network protocol analyzer, provides an array of filter syntax options for users to match and analyze specific packets or protocols. One such option is the ability to filter based on IP address. In this article, we will explore the syntax and examples of using Wireshark filters to match IP addresses.

Matching SIP To-Headers

One example of matching IP addresses in Wireshark involves filtering packets where the SIP To-header contains a specific string anywhere in the header. This can be achieved by using the 'contains' operator along with the desired string. For instance, to match packets where the SIP To-header contains the string 'a1762' anywhere in the header, the filter syntax would be:

sip.To contains 'a1762'

This will display all packets that contain the specified string in their SIP To-header.

Matching UDP Payload

Another example involves matching packets based on specific byte sequences in the UDP payload. The 'contains' operator can also be used to match packet payloads containing a specific 3-byte sequence of hexadecimal values. For instance, to match packets containing the 3-byte sequence 0x81, 0x60, 0x03 anywhere in the UDP header or payload, the filter syntax would be:

udp contains 81:60:03

This will display all packets that contain the specified byte sequence in their UDP headers or payloads.

Filtering on Vendor Identifiers

It is also possible to search for characters appearing anywhere in a field or protocol using Wireshark's 'contains' operator. For instance, to filter out noise and focus only on Windows devices, you can use the following syntax:

eth.addr=00:06:5B

This will restrict the display to packets from DELL machines only.

Filtering on MAC Addresses

The 'slice' feature in Wireshark is also useful for filtering based on vendor identifiers. By using this feature, you can filter on the vendor identifier part (OUI) of the MAC address. This can be particularly useful when trying to match homegrown packet protocols.

Filtering on Packet Payloads

Wireshark's 'contains' operator can also be used to filter packets based on specific byte sequences at the beginning or end of a packet payload. For instance, to match packets containing the 3-byte sequence 0x81, 0x60, 0x03 at the beginning of the UDP payload, skipping the 8-byte UDP header, the filter syntax would be:

udp contains 0x81:0x60:0x03

This will display all packets that contain the specified byte sequence at the beginning of their UDP payloads.

Filtering on Specific Protocols

Finally, Wireshark allows users to filter based on specific protocols or ports. For instance, to show only traffic in the LAN (.x) between workstations and servers, excluding Internet traffic, you can use the following syntax:

ip.src=192.168.0.0/16 and ip.dst=192.168.0.0/16

This will restrict the display to packets within the specified IP address range.

In conclusion, Wireshark's filter syntax options provide users with a powerful tool for matching and analyzing specific packets or protocols based on IP addresses. By using the 'contains' operator along with specific strings or byte sequences, users can tailor their captures to focus on specific traffic patterns or devices.

Wireshark filter syntax ip address