Download Practical Packet Analysis

Finding Packets
To find packets that match particular criteria, open the Find Packet dialog
(shown in Figure 4-1) by either selecting Edit from the main drop-down
menu and then clicking Find Packet or pressing CTRL-F on your keyboard.
Figure 4-1: Finding packets in Wireshark based on
specified criteria
This dialog offers three options for finding packets: display filter, hex
value, or string. The display filter option allows you to enter an expressionbased filter that will only find packets that satisfy that expression (this will be
covered later). The hex and string value options search for packets with a
hexadecimal or text string you specify; you can see examples of all these
things in Table 4-1. Other options include the ability to select the window
in which you want to search, the character set to use, and the direction in
which you wish to search.
Table 4-1: Examples of Various Search Types for Finding Packets
Search Type
Example
Display filter
not ip, ip address==192.168.0.1, arp
Hex value
00:ff, ff:ff, 00:AB:B1:f0
String
Workstation1, UserB, domain
Once you’ve made your selections, enter your search string in the text
box, and click Find to find the first packet that meets your criteria. To find
the next matching packet, press CTRL-N, or find the previous matching
packet by pressing CTRL-B.
Marking Packets
Once you have found the packets that match your criteria, you can mark those
of particular interest. Marked packets stand out with a black background and
white text, as shown in Figure 4-2. (You can also sort out only marked packets
when saving packet captures.) There are several reasons you may want to
mark a packet, including being able to save those packets separately, or to
be able to find them quickly based upon the coloration.
40
C ha pt er 4