For example, if you want to capture traffic on your wireless network, click your wireless interface. Capturing PacketsĪfter downloading and installing Wireshark, you can launch it and double-click the name of a network interface under Capture to start capturing packets on that interface. Don’t use this tool at work unless you have permission. Using the simple !ip.addr=192.168.1.Just a quick warning: Many organizations don’t allow Wireshark and similar tools on their networks. Numerous ICMP packets are what I call 'two-headed packets' - they contain two IP headers - the true IP header and another IP header in the ICMP portion of the packet.

Sake explained this quite eloquently at.

Here's the second issue that ActualRandy hit - his filter displayed an ICMP packet. Here's a version of the chart contained in Chapter 9 of the Wireshark Network Analysis book: If the IP destination address field contains 24.4.7.217 the packet will be displayed as well. If the field doesn't contain 24.4.7.217 -yippie! The filter matches and will be displayed. This filter looks in IP source address field first. An IP header has two IP fields - the source IP address field and the destination IP address field. Here's the first issue with this type of filter. If you hover over the field a tooltip explains that the filter may not work as desired. First of all - let's talk about the problem with a filter beginning with ip.src !=.Īs you can see from the image above, Wireshark turned the display filter area yellow to indicate something is wrong. Sake Blok spent a bit more time explaining what was going on here. What's up?Īvoid the use of != when filtering OUT IP address traffic. ip.src != 192.168.1.119 & ip.dst != 192.168.1.119 To my surprise, it returns some results with the that IP, such as this one: 157 238.065591 192.168.1.1 192.168.1.119 ICMP Destination unreachable (Port unreachable) The destination on this result is clearly one the filter should have blocked. I want to see results where neither the destination, nor the source are the specified a ddress here is my filter.

Another interesting question was posed at this week - it brings up a topic that I cover in the Wireshark 201: Filtering course (check out the schedule to catch the next free seminar on this topic).

Wireshark display filter yellow