wireshark 过滤方法汇总

比较符

eq, ==    Equal
ne, !=    Not Equal
gt, >     Greater Than
lt, <     Less Than
ge, >=    Greater than or Equal to
le, <=    Less than or Equal to

逻辑运算

and, &&   Logical AND
or,  ||   Logical OR
not, !    Logical NOT

搜索和匹配

contains
matches, ~

批量过滤

tcp.port in {80 1000 22} # 注意：不需要逗号分隔

切配操作

http.content_type[0:4] == "text"

来源ip或者目标ip过滤

# 来源ip
ip.src.addr == 192.168.0.110
ip.src.addr eq 192.168.0.110

# 目标ip
ip.dst.addr == 192.168.0.110
ip.dst.addr eq 192.168.0.110

端口过滤

tcp.port == 80 # 显示tcp协议来源端口或目标端口为80的
tcp.srcport == 80 # 只显示tcp协议的目标端口为80的
tcp.dstport == 80 # 只显示tcp协议的来源端口为80的

# 过滤端口范围
tcp.port >=1 and tcp.port <=80

协议过滤

udp
tcp
arp
icmp
http
smtp
ftp
dns
ip
ssl
...

# 排除某协议
!ip 或者 not ip # 过滤非ip协议

包长度过滤

ip.len < 200
tcp.len >= 100
udp.length == 1000 # udp不太一样

http过滤

http.request.method == 'GET'
http.request.method == 'POST'
http.request.uri contains "/q"

过滤域名

dns.qry.name == www.baidu.com