Geekly Articles each Day
📜 ⬆️ ⬇️

Display filters for network analyzers (Wireshark, Paketyzer)

1. Display filters


Traffic analyzers are a useful and effective tool in the life of a network administrator, they allow you to “see” what is actually transmitted on the network, which makes it easier to diagnose various problems or to study the principles of operation of various protocols and technologies.
However, quite a lot of various data blocks are often transmitted in the network, and if you force to display everything that passes through the network interface, it is difficult to select what is really needed.
To solve this problem, filters are implemented in traffic analyzers, which are divided into two types: capture filters and display filters. Last time we looked at capture filters. Today we will talk about the second type of filters - about display filters.
Display filters are a kind of filters that allow you to display only those frames that are currently needed (belong to a specific protocol and / or host), temporarily hiding all the others.
The rules for writing display filters are different from the rules for writing capture filters. Differing not so big, but usually sufficient to ensure that the capture filter rule without any changes would not work when applied as a display filter.

2. Syntax of display filters


A display filter expression consists of a set of special primitives, which are built from the so-called classifiers and object identifiers (addresses, names of network objects, port numbers).
Note : all classifiers are case-sensitive and must be written in small letters only.

The classifiers in the display filter are not divided into types, they use keywords that correspond to protocols at different levels of the OSI model. The simplest example of using a classifier is the name of the protocol (ip, dns, arp, etc.), by entering which as a display filter we will force the program to leave on screen only those frames that contain the specified protocol. It should be remembered that all captured frames get into RAM, and by canceling the display filter you will be able to see all the cards captured by the analyzer (all that have passed the capture filter).
One of the differences between the display filters is that you can access certain protocol parameters by specifying the name of this parameter through a period after the protocol name, for example:

And in fact, often, writing a display filter is reduced to finding the correct name of the protocol or parameter of this protocol.
Comparison operators are used to compare field values:

All protocol parameters (identifiers) are typed and depend on the specific parameter of a particular protocol.
The list of valid identifier types is as follows:

Integers and addresses can be represented both in decimal and hexadecimal format:

In the case of logical values, true is equivalent to 1 and false is equivalent to 0 .
In hardware addresses, numbers can be separated by a colon (:), a dot (.), A dash (-):

IP addresses, as well as numbers, can be compared with each other in the same way as numbers using the comparison operators eq , ne , gt , ge , lt , le .
Instead of numeric addresses, you can use symbolic addresses as node addresses, but you need an available name resolution service:

When describing networks, you can use a short mask option, you can also apply a mask to symbol addresses:

The display filter can work with the proto [ offset : size ] primitive, as well as the capture filter, but there are some differences with its use:

Examples of using the proto [ offset : size ] primitive in advanced display filters:

All rules can be combined by logical connectives:

For example:

The priority of these operations is as follows:

As in ordinary mathematical expressions, the priority can be changed using round brackets (), in which actions are performed first.

Attention :
You should be careful when formatting filters that describe the requirements for repeating fields, for example, IP addresses, because in the IP header, the IP address is met twice - the sender's address and the recipient's address. The following two filters, despite the apparent sameness, will work differently:
ip.addr ne 1.1.1.1
not ip.addr eq 1.1.1.1
The first filter means “show all frames in which there is an address different from 1.1.1.1 in the IP packet header” and, as a result, if the sender’s address or the recipient’s address is different, then the frame containing such a header will be displayed, although the second the address may be the same as 1.1.1.1.
The second option means “to show all frames in which there is no 1.1.1.1 address in the IP packet header”, so for the frame to be displayed it is required that the sender’s address or the recipient address in the IP header does not match 1.1.1.1.

Also be careful in the rules excluding certain packages. For example, we want to exclude from the display all frames for which the recipient's IP address is any address other than 1.1.1.1. If you apply the following filter:
ip.dst ne 1.1.1.1
then all the frames in which there is no this IP address of the recipient, as well as those frames in which it could not be (for example, ARP) will be removed from the capture. If we also need non-IP traffic, then we need to fix the filter for this:
not ip or ip.dst ne 1.1.1.1

')

3. List of protocols and their parameters


Having studied the basic rules of writing mapping filters, it remains to understand only where to find the list of supported protocols and from the parameters. The list of protocols and their parameters is quite extensive and there is no point in bringing it here, it can be found at the link on the wireshark.org website

Successful sniffing)

Source: https://habr.com/ru/post/211292/

More articles:


All Articles