Hak5 Cyber Security Education, Inspiration, News & Community since 2005:
____________________________________________
On today's HakTip, Shannon Morse discusses the Display Filter Box and several options you have for saving filters within Wireshark.

One question I got from last week's episode was "What happens to the rest of your packets when you use the filter box?". This box is for Display Filters. Whenever you use it after running a packet capture, it'll just display whatever you typed in. Everything else is simply omitted until you clear the filter text box. The Expression box will basically fill in the expressions the same way. Click Expression, then choose a Field name and preferred expression. Choose the relation, and the value. The value for an IPV4 protocol would be an IP address. You can also choose from predefined values if available. Once you hit OK the new filter will show up in the filter box. Hit enter to run that filter. If you want to save your filter, hit save, name it, and hit OK. How you can just click on the bookmarked filter and it'll run. Let's have some more fun. If you want to view packets of a specific size, use frame.len less than sign= 128. I could also use ==, !=, greater than sign, less than sign, less than sign=, or greater than sign=. And if I have two expressions I want to combine, use the &&, bracket bracket, not, or xor. xor means one and only one condition must be true. Nor means neither condition is true.
You might end up writing out a really long filter. You have a lot of options to save them, luckily. You can use the save button next to the filter display box. Of you can use the filter button next to the box. Lastly, you can also use the analyze display filters option.
Now let's have some fun with Endpoints. These are where the data is going to and coming from, so there's usually a twoended conversation happening within your packet captures. To see traffic between endpoints, click Statistics Endpoints. Clicking Statistics Conversations will show you address A and address B for each conversation, separated by protocol.
Let me know what you think. Send me a comment below or email us at [email protected]. And be sure to check out our sister show, Hak5 for more great stuff just like this. I'll be there, reminding you to trust your technolust.

~~~~~~~~~
Please watch: "Bash Bunny Primer Hak5 2225"
   • Bash Bunny Primer  Hak5  2225  
~~~~~~~~~
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.