Wireshark

Archived

This page has been archived and will receive no further updates.

Capturing packets using tcpdump for viewing using Wireshark

https://www.wireshark.org/docs/wsug_html_chunked/AppToolstcpdump.html

Filtering

  • Type your filter in the text box near the top that says Apply a display filter and press Enter

  • Filter by source IP:

    ip.src==192.168.0.1
    
  • Filter by destination IP:

    ip.dst==192.168.0.1
    
  • Combine filters using and/or:

    ip.src==192.168.0.1 and ip.dst==192.168.0.1
    ip.src==192.168.0.1 or ip.dst==192.168.0.1
    

View absolute dates/times instead of relative

View > Time Display Format > Date and Time of Day

Traffic flow graph

Statistics > Flow Graph

Show one specific connection/session from start to finish

  1. Right-click one of the packets in the connection > Follow > TCP Stream

  2. A window will pop up with the TCP stream contents, which you can close