SharkFest ’18 ASIA

Filter Maniacs
Goodies about display and capture filter

Megumi Takeshita
Sample trace and configuration

Packet Otaku, ikeriri network service

https://www.ikeriri.ne.jp/sharkfest#sf18asia#sf18asia •• NEC,
NEC, Nanyang
Nanyang TechnologicalTechnological University,
University, Singapore
Singapore •• April
April 9-11
9-11

Megumi Takeshita, ikeriri network service
••
•
•
•

Founder, ikeriri network service co.,ltd
Wrote 10+ books about Wireshark
Reseller of Riverbed Technology ( former
CACE technologies ) in Japan
Attending all Sharkfest
Translator of QT Wireshark into Japanese#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Filter Maniacs
TIPS and techniques about Wireshark display
filters and WinPcap/libpcap capture filters.
Wireshark has flexible and strong functions tofilter packets, display filter by Wireshark, andcapture filter by WinPcap/libpcap. We cancapture the only packets you want and reduce
trace file size using capture filters, and we canshow the series of packets by display filter in a
trace file.
This session Megumi shows practical TIPS andconvenient techniques to use both filter using
actual filter strings and trace files. You can utilize
them in trace file and get the packet you need.
#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-113

Agenda•••••Capture and Display Filter Basics
Capture Filter TIPS
Display Filter TIPS
Display filter Techniques
Q&A#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

•Capture and Display
Filter Basics#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Capture filter and Display Filter• Capture filter is used by WinPcap/libpcap/Npcap
and other capture drivers to filter packet data
• Display filter is used by Wireshark/tshark/dumpcap
to filter display information of packet list pane
• Each text box is able to use auto complete

Display Filter
Capture Filter#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Difference between Capture and Display filter
Capture Filter

Display Filter

Set byWinPcap/libpcap/Npcap
and packet capture driver

Wireshark

Applies to

Each interface

Each trace file

SyntaxTcpdump, pcap_compile(),and pf()

Wireshark
protocol.field.subfield

Layer

Under layer 4 based on
tcpdump, pcap_compile()

All layer based on the fieldsof the Wireshark's dissector

Pcap file size

ReducedNo change

Statistics

X Bad
Ratio of packets is changed〇 GoodRatio of packets is the same

#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

History of filter• If you once set Capture / Display filter,
the latest filter string is saved in filter list,
and also saved in recent_common file in Personal
configuration folder• The number of history
can be changed in settings#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#1 check and test filter• Open Wireshark, set Capture filter ( host 8.8.8.8 ) and start••••

capturing, and stop.
Open another Wireshark, set Display filter( ip.addr==8.8.8.8 ) and start capturing and stop.
Check the difference of each Syntax, file size and statistics
Open Personal Configuration folder by Help>About>Folders
and open recent_common file.
Check the number of history by Edit>Preferences( show up to XX filter entries, XX recent files )#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Configuration files of each filter• Open Help>About Wireshark>Folders• We can edit dfilters ( Display filter template) andcfilters ( Capture filter template ) in Global
configuration and Personal configuration(filter format using UTF8N and LF in Windows)• You can also edit filters using filter dialog box
Capture>Capture Filter…
Analyze>Display Filter#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Check in Global configuration#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Common example of Capture and Display filters
Address/port

Capture filter

Display filter

Source MAC address

ether src hosteth.src

Destination MAC address

ether dst hosteth.dst

Src and Dst MAC address

ether hosteth.addr

Source IPv4 address

src host

ip.srcDestination IPv4 address

dst host

ip.dstSrc and Dst IPv4 address

hostip.addr

Source TCP port

tcp src port

tcp.srcport

Destination TCP port

tcp dst port

tcp.dstport

Src and Dst TCP port

tcp port

tcp.port#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#2 Create your own filter template• Create your own cfilters and dfilters and copy
them into personal configuration from cfilter1and dfilter1 and history• Restart Wireshark and check each filter#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Capture filter TIPS

#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Capture Filter Syntax• Capture filter is set on each interface,
Select interface then put filter string• Capture filter syntax is derived from tcpdump,
pcap_compile() and pf() firewall• Capture filter is concerned
about under Transport layer
header information(radio, ether, wlan, ppp, ip,ipv6, arp, rarp, tcp,udp, icmp)• Different from Display filter
Wireshark / TShark

TreeDissectorsPlugins

libwireshark

Displayfilters

libwiretap

libwiretap

dumpcap

WinPcap / libpcap / Npcap#sf18asia • NEC, Nanyang Technological University, Singapore Live• dataApril 9-11

Capture filename and network and port
• You can use hostname in capture filter string[ src | dst ] host www.ikeriri.ne.jp• network address in capture filter string[ src | dst ] net 172.16[ src | dst ] net 192.168 mask 255.255.255.0• Broadcast and Multicast[ ip ] broadcast and multicast• The port from 0 – 1023
[ tcp | udp ] portrange 0-1023#sf18asia • NEC, Nanyang Technological University, Singapore • April16
9-11

Examples"Source host name" src host www.ikeriri.ne.jp"Destination host name" dst host www.ikeriri.ne.jp"Src and Dst host name" host www.ikeriri.ne.jp"Src and Dst Network 172.16.0.0" net 172.16"Src and Dst Network 192.168.0.0/24" net 192.168 mask 255.255.255.0"Src Network 172.16.0.0" src net 172.16"Dst Network 192.168.0.0/24" dst net 192.168 mask 255.255.255.0"Ethernet broadcast and multicast" broadcast and multicast"IP broadcast and multicast" ip broadcast and ip multicast"Well known TCP port" tcp portrange 0-1023"Well known UDP port" udp portrange 0-1023#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Byte value, Frame size and VLAN/WLAN•Set frame size using less or grater
less 100 means capture only under 100bytes frame
greater 1000 means capture only over 1000bytes frame•

VLAN trafficvlan [ vlanid ] ( check name resolution setting )•WLAN management, control, and data frame
type [ mgt | ctl | data ]•WLAN subtype ( Beacon, Probe Request, Probe Response, Authentication,
Association Request, Association Response, ACK, RTS, CTS, Deauthentication
and Disassociation WITH AirPcap and other wireless capture devices)
subtype [ beacon | probereq | proberesp | auth | assocreq | assocresp |ack | rts | cts | deauth | disassoc ]•WLAN trafficwlan [ host | src | dst ]#sf18asia • NEC, Nanyang Technological University, Singapore • April18
9-11

Examples"Frame size is under 100" less 100"Frame size is over 1000" greater 1000
"IEEE802.1Q vlan frame" vlan

"VLAN ID is 10" vlan 10"IEEE802.11 Wireless lan" wlan
"IEEE802.11 MAC address 00:90:cc:11:11:11" wlan host 00:90:cc:11:11:11"IEEE802.11 Souce address 00:90:cc:11:11:11" wlan src 00:90:cc:11:11:11"IEEE802.11 Destination address 00:90:cc:11:11:11" wlan dst 00:90:cc:11:11:11"IEEE802.11 Management frame" type mgt"IEEE802.11 Control frame" type ctl"IEEE802.11 Data frame" type mgt#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples"IEEE802.11 Beacon frame" subtype beacon"IEEE802.11 Probe Request frame" subtype probereq"IEEE802.11 Probe Response" subtype proberesp"IEEE802.11 Authentication" subtype auth"IEEE802.11 Association Request" subtype assocreq"IEEE802.11 Association Response" subtype assocresp"IEEE802.11 ACK frame" subtype ack"IEEE802.11 RTS frame" subtype rts"IEEE802.11 CTS frame" subtype cts"IEEE802.11 Deauthentication frame" subtype deauth"IEEE802.11 Disassociation frame" subtype disassoc#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#3 collect only Wi-Fi connection• Modify capture filter in
Personal configuration
using cfilter2 and set“collect only WiFi
connection”
Note: it needs
IEEE802.11 wirelesscapture driver#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Display filter TIPS

#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Display Filter Syntax• Filter syntax is Protocol.field.subfield style• Display filter is set on each capture file, setfilter string in text box of display Filter toolbar• Display filter syntax is derived from each protocol
dissector of Wireshark, look at each field of packet
detail pane and status bar.
• Display filter is concerned about all layer andgenerated fields such as GeoIP, Expert info, time
#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Color of filter text box• Red means Error
Filter string is not applied.
• Green means OK.
• the filter string can be applied• Yellow means Warning
the filter string can be applied but
there are some ambiguous or contradiction
look status bar and USE BRACKET to fix#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Cannot remember Filter String,
select the field to right click• If you cannot remember filter string,

select each field of Packet detail pane.
• Wireshark display filter is derived fromprotocol dissectors, so look status bar.
• Select the field in Packet Detail Pane,
Just right click to [ Apply | Prepare ]Filter > [ Selected | Not Selected |…and Selected | …or Selected |… and not Selected | …or not Selected#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Which one is good for Display Filter ?
Apply or Prepare, try Prepare !
• If you create display filter
in huge pcap/pcapng file,please try “Prepare Filter”, • “Apply Filter” works
you can edit and check
immediately, so it
Display Filter string in
may take several
Filter textbox.
minutes to finish.
• You can also add anotherfilter string using “PrepareFilter”#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Create Display Filter Button• It is good idea to create Display Filter Button in case ofcommonly use such as device MAC address.

Click [+] to create button
Set alias name

The same filter string of Display filter toolbar textbox at default• You can add/del/edit Filter Button
Edit>Preference>Filter Buttons#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Name Resolution• Only Physical Address can be resolved at Default.
• You need to check “Resolve Network Address” inView>Name Resolution to use host name.

• Wireshark use manuf, hosts, services files in GlobalConfiguration.
• You can also refer external DNS and DNS packet
information to resolve name if you configure.

#sf18asia • NEC, Nanyang Technological University, Singapore • April28
9-11

manuf, hosts, services• You can edit manuf, hosts, services files to add
your custom Name resolution aliases#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

MAC Address Resolution• You can use alias name of MAC address
eth.addr_resolved (wlan.addr_resolved)
eth.src_resolved (wlan.sa_resolved )eth.dst_resolved (wlan.da_resolved )• If you want to look for Nintendo Switch
type “wlan.addr_resolved contains Nintendo”#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Host Name Resolution• You can use host name in Display Filter
ip.host ip.src_host ip.dst_host( View>Name Resolution> Resolve Network Address )• You also need to refer Edit>Preference>Name Resolution#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter2)“Sony’s MAC address” eth.addr_resolved contains Sony“source MAC address of Sony” eth.src_resolved contains Sony“destination MAC address of Sony” eth.dst_resolved contains Sony
“Nintendo’s wireless MAC address” wlan.addr_resolved contains Nintendo“source wireless MAC address of Nintendo” wlan.sa_resolved contains Nintendo“destination wireless MAC address of Nintendo” wlan.da_resolved contains Nintendo“Japan domain host” ip host contains jp“source host of ikeriri” ip.src_host contains ikeriri“destination host of ikeriri” ip.dst_host contains ikeriri#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#4 edit your own alias• Edit manuf and add alias of your own MACaddress in Global configuration• Edit hosts and add alias of your IP address too• Check Resolve Network Address• Restart Wireshark and start capturing#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Display filter Techniques#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Multiple address and port
• If you want to grab the range of IP address andmultiple port, there are some ways to filter packets.
• Filter IP Network
ip.src>=192.168.100.0 and ip.src<=192.168.100.255

ip.addr==192.168.100.0/24• Filter HTTP and SSL port
tcp.port == 80 or tcp.port == 443
tcp.port in {80 443}

#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter3)“all address of network 192.168.100.0” ip.addr==192.168.100.0/24“the range from 192.168.100.10 to 20” ip.src>=192.168.100.0 andip.src<=192.168.100.255“TCP HTTP and SSL port” tcp.port in {80 443}

#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Slices [] in Display Filter• You can match hex value using slices []typically used with eth, eth.src, eth.dst, ip, tcp, udp and otherheader ( sometimes may not work as you expected )• [ start byte index : length ]eth.src[0:3] first 3 bytes in ethernet source address• [ start index – end index ]eth.dst[1-2] second, third bytes of ethernet destination• [ : size ]
ip[:2] first 2 bytes of IP header#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter4)“OUI 00:D0:F1 (SEGA ENTERPRISES, LTD)” eth[0:3]==00:D0:F1“second, third bytes of ethernet source is ff:ff” eth.src[1-2]==ff:ff“second, third bytes of ethernet destination is ff:ff” eth.dst[1-2]==ff:ff“IP version 4, length 20 TOS(DiffServ)=0 (first 2 bytes of IP header)” ip[:2]==45:00“TCP destination port ( from index 2 length 2 bytes ) is 80(0x0050)” tcp[2:2]=00:50#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Relation ( contains / matches )• Display filter string is commonly used with relation( eq(==), gt(>), lt(<), etc. )• You can also use relation (and, or, not, xor)
• “contains” is convenient relation as wildcard ofstring value ( ex. http.request.uri contains ikeriri• “matches” is the relation of PCRE (Perl Compatible
Regular Expressions )#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Direct search of specified bytes value• You can search specified bytes value in capture
file using Display filters with “contains” relation• Each file has a marker, the specified bytes
value, for example JPEG file has a marker ofStart (SOI: start of image ) as “FF D8 FF”• You can look for frame, tcp.segment, and more
example frame contains ff:d8:ff#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter5)“all frames that contains JPEG file SOI marker” frame contains FF-D8-FF“all frames that contains PNG file signature (png.signature)” frame contains
89:50:4e:47:0d:0a:1a:0a“find suspicious packets of Windows Executables (MZ marker)” frame contains
4D:5A“find suspicious packets of Uboat RAT (remote access trojan) malware” framecontains 34:38:38#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#5 sample use of PERC
• Search Japanese local phone number in packets
xx-xxxx-xxxx (first digits appears 2-5 times, second digits
appears 1-4 times, and last digits appears 4 times )frame matches "[0-9]{2,5}¥-[0-9]{1,4}¥-[0-9]{4}”(Note: in a single byte environment escape character “¥” should be•removed.) ¥ is backslash in Japanese keyboard map
Search email address (any composite of alphabet, numberand ._%+- ,@, any composite of subdomain and top level domain)

frame matches “[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.]+[.][a-zA-Z]{2,4}”#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter6)"Japanese local phone number in packets" frame matches "[09]{2,5}¥-[0-9]{1,4}¥-[0-9]{4}""Search email address" frame matches "[a-zA-Z0-9._%+-]+@[a-zAZ0-9.-]+[.][a-zA-Z]{2,4}"#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Use Wireshark generated fields• Display filter can refer generated fields as wellas actual field of the dissectors• You can use time and duration value ofWireshark generated field
ex. icmp.resptime > 1
ex. http.time > 1 or dns.time > 0.5
ex. tcp.analysis.initial_rtt > 0.03
ex. frame.time_delta_displayed > 1• Please refer to dfilter7#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Examples (dfilter7)"Any frame that Ping responds in more than 1 second" icmp.resptime > 1"Any frame that HTTP responds in more than 1 second" http.time > 1"Any frame that DNS responds in less than 0.5 second" dns.time < 0.5"Any frame that TCP initial Round Trip Time is more than 0.03 seconds"
tcp.analysis.initial_rtt > 0.03
"Any frame that the time duration from previous displayed packet is more than 1second" frame.time_delta_displayed > 1#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

#6 use GeoIP• Set GeoIP database directories in Name Resolutionof Preferences > Name Resolution• Try to capture packets of Japanese website• Try to filter packets using
ip.geoip.country contains Japan or
ipv6.geoip.country contains Japan#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

At last use multibytes• open chiyodanyan.pcapng• Try to use ( if you have amultibytes character
environment )frame contains "千代田“• Wireshark can use
UTF-8 characters
including our CJK
multibytes !
#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11

Q&A

ワイヤーシャークを使おう！
どうもありがとうございました！
#sf18asia • NEC, Nanyang Technological University, Singapore • April 9-11