This allows you to analyse the traffic captured in more detail. When you stop a wireshark session you can save the output to a file.

As Figure A shows, wireshark output consists of two panes: the top pane shows the packets, while the bottom pane shows details of packets highlighted in the top pane. Clicking on the icon next it (circled in red) stops the capture. Starting a capture is simply a matter of clicking on the icon shown circled in green on Figure A. Wireshark can be started from the command line, but it usually needs to be run as root or as sudo. This week’s post provides a brief introduction to wireshark and shows two basic filters that can be used to extract two different classes of traffic. Wireshark is a protocol analyser available for download. Scott Reeves shares the wireshark filters that helps you isolate TCP and UDP traffic. If you want to filter out all packets containing IP datagrams to or from IP address 1.2.3.4, then the correct filter is !(ip.addr = 1.2.3.4) as it reads “show me all the packets for which it is not true that a field named ip.addr exists with a value of 1.2.3.4”, or in other words, “filter out all packets for which there are no occurrences of a field named ip.addr with the value 1.2.3.4”.Two simple filters for wireshark to analyze TCP and UDP traffic As an IP datagram contains both a source and a destination address, the expression will evaluate to true whenever at least one of the two addresses differs from 1.2.3.4. The reason for this, is that the expression ip.addr != 1.2.3.4 must be read as “the packet contains a field named ip.addr with a value different from 1.2.3.4”. Instead, that expression will even be true for packets where either source or destination IP address equals 1.2.3.4.

Unfortunately, this does not do the expected.

Then they use ip.addr != 1.2.3.4 to see all packets not containing the IP address 1.2.3.4 in it. Often people use a filter string to display something like ip.addr = 1.2.3.4 which will display all packets containing the IP address 1.2.3.4. Using the != operator on combined expressions like eth.addr, ip.addr, tcp.port, and udp.port will probably not work as expected. Wireshark allows you to string together single ranges in a comma separated list to form compound ranges as shown above.

Wireshark display filter port