Wireshark 101: Display Filters and Filter Options; HakTip 122 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by hack
5 and viewers like you
support us directly at hack shop com
welcome to active the show we break down
concepts tools and techniques for
hackers gurus and I Tina and Jess I'm
Shannon Morse and today we are checking
out more Wireshark and expressions now
one question that I got from last week's
episode was what happens to the rest of
your packets when you use the filter box
so I wanted to explain this filter box
up here a little bit so this
specifically is called the box for
display filters so display filters or
anything that are going to change the
display that you get on your output menu
all the different packets that you see
down here so if I go up here and I
change something to IP P address equals
equals this is a pretty simple one but
you'll get the idea
point five nine so I'm looking
specifically for this address of 0.59 I
hit enter it's going to erase anything
that does not have to do with 0.59
you'll notice if it does I can still
view it hence display filter so whenever
you use it after running a packet
capture it'll just display whatever you
typed in everything else is simply
omitted until you clear the filter text
box and then everything appears back
again so it's just stored in the
Wireshark memory and it does come back
it doesn't get fully erased so you can
still save your entire packet capture
you'll just be able to save separate
things depending depending on the
display box now the expression box will
basically fill in the expressions the
same way if I click on expression over
here so I'm going to erase this real
quick
hit enter bring back everything so if I
hit expression box this is pretty
interesting right you can choose a field
name so I could choose any preferred
expression so I'll just do I PV for
let's go down to IP there it is
ipv4 so I'll click in here and choose
IPP addr and then I can choose any kind
of relation so the relation can be
equals equals four it equals does not
equal greater than less than greater
than or equal or less than an equal so
I'll just choose equals equals and
then it will give me the option to put
in a value so the value for an IP V
protocol would be the IP address you can
also choose from predefined values if
that's available so predefined what
values will pretty much just be whatever
Wireshark assumes that you might want to
plug in as the value for whatever the
field name might be and I'll choose I'll
just use the same IP address as my
default so I'll just do the ten dot 7330
1.59 and when I hit enter it'll plug it
in for me up here it'll go ahead and
show the display for all of the ones
having to do with that specific IP
address that you entered into the
expression box yay now if you hit enter
that filter already runs for you you
don't have to type in anything yourself
if you want to save your filter you can
also do that you can just sit hit save
over here and then enter a filter name
for example I'll just put in example one
and then hit OK and it'll save right
over here pretty much kind of like a
little bookmark so you'll see I have hat
tip one over here which shows a IP
address that I used on a different
network so I can hit example 1 and
that'll show me the recent packet
capture would just this IP ik @ IP
address so pretty easy now you can just
click on the bookmark filter and it'll
run for you yeah you less typing is
always good now let's have some more fun
if you want to view packets of a
specific size that's kind of cool you
can actually do that you can type in
frame dot length or le n Lin and then
I'll do greater than I'm sorry less than
or equal to 128 and then hit enter and
it'll show me any packets that are that
specific size less than or equal to 128
if I switch that around do greater than
it'll show me the ones that are greater
than 128 or I could do equals equals or
I could do the exclamation mark equals 4
just not equaled 128 greater than or
less than by themselves or I guess that
would be backwards for you guys and if I
have two expressions that I want to
combine I could also use the N and the
ampersand ampersand the two pipes so for
naught does not equal and then I
could use not oars oars so that's XOR so
XOR means one and only one condition
must be true so it's either the first
one or the second one and nor means
neither condition is actually true now I
have a couple of other expression
options for you as well as a few other
handy tips right after the break more
after our sponsor the hack shop is hack
fives premier store for all your pen
testing needs including one of my
favorites the USB rubber ducky which
looks like a flash drive and it types
like a keyboard and it can type scripts
into a computer ridiculously quickly
like this week's favorite from koi acai
Koon now this script replaces say a
site's IP with your chosen server's IP
for the hosts file now of course we
couldn't do the show without your
support so we would like to thank you
with something special use the coupon
code snubs SN UBS with any order out of
the entire hack shop for your very own
signed hacked tip stickers and again
thank you so so much for supporting this
show we're back with more we're sharp
expressions and super much fun times
with the filter box super much fun times
because that makes sense now I'm going
to move on with some longer IP address
filters that I came up with so you might
end up writing something that's really
really long and you might want to use
this filter several different times and
not have to type it in every single time
now of course I could use the little
Save button that I showed you earlier
over at the side but you do have a lot
of other options to save them as well
now you can use the Save button next to
that filter display box or you can also
use the filter button next to the box so
if I went over here and I hit filter I
could create this new filter a filter
string down here and I can name it
something new so I could type in I'm
going to hit copy on this hit new and
we're going to call it example 2 hit
apply and now you have a new filter
right here that you can always access
and it's saved me yay lastly you can
also use the analyze display filters
options so this is found under the
analyse toolbox and if you
/ to display filters you have a whole
bunch of different options basically the
same exact box but it's just another way
that you can get to it now let's have
some fun with endpoints so this is where
the data is going to and coming from so
there's usually a two ended conversation
happening within your packet captures so
you have your source and then you have
your destination and generally there's
nothing in between those two sources
destination and source now to see
traffic between endpoints you can click
on statistics and then go to endpoints
so if you go up to the statistics go
down to endpoints and it might take a
little bit of time to load if you have a
really really long packet capture but
this is going to show you everything
that's involved in those endpoints you
can also click on statistics and go to
conversations so it looks kind of
similar so I'll close that and go to
statistics choose conversations so
you'll notice they both have the same
icon except one has two so click on that
one it has conversations takes a little
bit of time to load again you'll notice
in this one you have address a for your
source and address B for your
destination and those are separated by
some kind of protocol so for example
I'll click on address a and you'll see
several the same one so I have this
Synology there's a couple of different
so knowledge ease but they have
different address beats so different
destinations if I go down to this one FB
so you may see several different FB ones
this ipv4 let's see what is this M cast
underscore FB may be found on Facebook
Samsung Intel Core Apple so it looks
like it's reaching out to a whole bunch
of different destinations and if you
have several different ones going to the
same destination those will also be
separated by what kind of protocol it's
in so this can be very very handy if you
just want to break things down just a
little bit more so you can focus in on a
specific source or a specific
destination instead of having to fill
out some kind of specific expression in
your filter box now another way to make
things easier I love when things are
easier let me know what you think below
or you can send me a comment you can
email us over at tips at hak5 org I do
read all of the emails so thank you so
much for all your comments and be sure
to check out our sister show hack 5 for
more great
just like this I'll be there reminding
you to trust your Tecna less