[学习]WireShark 的过滤功能

最新推荐文章于 2025-07-02 11:34:57 发布

转载最新推荐文章于 2025-07-02 11:34:57 发布 · 162 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/jinanxiaolaohu/p/9860581.html

文章标签：

#网络

本文详细介绍Wireshark中各种高级过滤方法，包括协议、IP地址、端口、MAC地址及HTTP方法过滤，助您精准捕获网络数据包。

1. 打开 wireShark 过滤显示协议

比如显示arp协议

过滤栏输入arp即可

支持的协议类型

TCP
UDP
HTTP
FTP
ICMP
SMTP
等等

2. 过滤ip地址

ip.addr eq 10.24.13.6

or

ip.addr == 10.24.13.6

或者是区分 源地址或者是目标地址

ip.src == 10.24.13.6
或者目标地址
ip.dst eq  10.24.13.6

3. 过滤端口以及增加 and 条件等.

tcp.port == 80 || ip.src eq 10.24.13.97

4. mac地址过滤

eth.dst

eth.src

eth.addr

5. http 方法过滤

http.request.method == "GET"
http.request.method == "POST"
http.request.uri == "/img/logo-edu.gif"
http contains "GET"
http contains "HTTP/1."

// GET包
http.request.method == "GET" && http contains "Host: "
http.request.method == "GET" && http contains "User-Agent: "
// POST包
http.request.method == "POST" && http contains "Host: "
http.request.method == "POST" && http contains "User-Agent: "
// 响应包
http contains "HTTP/1.1 200 OK" && http contains "Content-Type: "
http contains "HTTP/1.0 200 OK" && http contains "Content-Type: "