Wireshark Filter Fundamentals

When analyzing network traffic with Wireshark, filters are essential for navigating through large packet captures. They help isolate specific protocols, IP addresses, or port communications.

Filter Expression Syntax

• Protocol filtering: tcp or udp to display only TCP or UDP packets
• IP adress filtering: ip.src == 192.168.1.102 or ip.dst == 192.168.1.102
• Port filtering: tcp.port == 80 or tcp.srcport == 80
• HTTP method filtering: http.request.method == "GET"
• Logical operators: AND, OR for combining conditions

Common Filter Expressions

UDP Protocol Analysis

Let's examine UDP packet structure by analyzing a sample capture. The following shows a UDP packet breakdown:

Physical Layer Analysis

# Packet 211: 377 bytes on wire (3016 bits), 377 bytes captured (3016 bits) on interface \Device\NPF_{4A7CD894-2EED-****-****-ABC****5A3**}, id 0
Interface id: 0 (\Device\NPF_{4A7CD894-2EED-****-****-ABC****5A3**})
Interface name: \Device\NPF_{4A7CD894-2EED-****-****-ABC****5A3**}
Interface description: Ethernet
Encapsulation type: Ethernet (1)
Arrival Time: Nov 4, 2020 17:23:43.695577000 China Standard Time
Epoch Time: 1604481823.695577000 seconds
Time delta from previous captured frame: 0.120236000 seconds
Frame Number: 211
Frame Length: 377 bytes (3016 bits)
Capture Length: 377 bytes (3016 bits)
Protocols in frame: eth:ethertype:ip:udp:oicq
Coloring Rule Name: UDP
Coloring Rule String: udp

Data Link Layer Analysis

# Ethernet II frame
Ethernet II, Src: Tp-LinkT_84:**:** (d0:76:**:**:**:*1), Dst: Dell_d0:6f:** (8c:ec:**:**:**:*8)
Destination: Dell_d0:6f:** (8c:ec:**:**:**:*8)
Source: Tp-LinkT_84:**:** (d0:76:**:**:**:*1)
Type: IPv4 (0x0800)

Network Layer Analysis

# IPv4 packet
Internet Protocol Version 4, Src: 61.1**.***.**3, Dst: 192.168.1.100
Version: 4
Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 363
Identification: 0x4584 (17796)
Flags: 0x4000, Don't fragment
Fragment offset: 0
Time to live: 46
Protocol: UDP (17)
Header checksum: 0x5385 [validation disabled]
Source: 61.1**.***.**3
Destination: 192.168.1.100

Transport Layer Analysis

# UDP datagram
User Datagram Protocol, Src Port: 8000, Dst Port: 4020
Source Port: 8000
Destination Port: 4020
Length: 343
Checksum: 0xe2b0 [unverified]
Timestamps:
    Time since first frame: 3.965476000 seconds
    Time since previous frame: 0.241175000 seconds

Application Layer Analysis

# OICQ application data
OICQ - IM software, popular in China
Flag: Oicq packet (0x02)
Version: 0x3949
Command: Receive message (23)
Sequence: 7835
Data(OICQ Number): 76523**58

TCP Three-Way Handshake

The TCP three-way handshake establishes a reliable connection between client and server. Let's analyze the packet exchange:

Handshake Process

1. SYN from client: Client sends SYN flag to initiate connection
2. SYN-ACK from server: Server responds with SYN-ACK to acknowledge and synchronize
3. ACK from client: Client sends final ACK to establish the connection

First Packet (Client to Server)

# TCP SYN packet
Transmission Control Protocol, Src Port: 10625, Dst Port: 443, Seq: 0, Len: 0
Source Port: 10625
Destination Port: 443
Sequence number: 0
Header Length: 32 bytes (8)
Flags: 0x002 (SYN)
Window size value: 64240
Checksum: 0x1496 [unverified]
Options: (12 bytes), Maximum segment size: 1460 bytes, Window scale: 8

Second Packet (Server to Client)

# TCP SYN-ACK packet
Transmission Control Protocol, Src Port: 443, Dst Port: 10625, Seq: 0, Ack: 1, Len: 0
Source Port: 443
Destination Port: 10625
Sequence number: 0
Acknowledgment number: 1
Header Length: 32 bytes (8)
Flags: 0x012 (SYN, ACK)
Window size value: 29200
Checksum: 0x2f4a [unverified]
Options: (12 bytes), Maximum segment size: 1448 bytes, SACK permitted, Window scale: 9

Third Packet (Client to Server)

# TCP ACK packet
Transmission Control Protocol, Src Port: 10625, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
Source Port: 10625
Destination Port: 443
Sequence number: 1
Acknowledgment number: 1
Header Length: 20 bytes (5)
Flags: 0x010 (ACK)
Window size value: 514
Checksum: 0xe020 [unverified]

TCP Four-Way Handshake

TCP connections are terminated using a four-way handshake, allowing each direction to close independent:

Handshake Process

1. FIN from server: Server initiates termination
2. ACK from client: Client acknowledges server's FIN
3. FIN from client: Client initiates its own termination
4. ACK from server: Server acknowledges client's FIN

First Packet (Server to Client)

# TCP FIN-ACK packet
Transmission Control Protocol, Src Port: 443, Dst Port: 10354, Seq: 70058, Ack: 114, Len: 0
Source Port: 443
Destination Port: 10354
Sequence number: 70058
Acknowledgment number: 114
Header Length: 20 bytes (5)
Flags: 0x011 (FIN, ACK)
Window size value: 66
Checksum: 0x26f8 [unverified]

Why Four Steps?

TCP is full-duplex, meaning each direction must be closed separately. The server may still have data to send after receiving a FIN, requiring an additional step for proper termination.

ICMP Protocol Analysis

ICMP (Internet Control Message Protocol) operates between network and transport layers, primarily used for error reporting and diagnostics.

ICMP Echo Request

# ICMP request packet
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x4a0f [correct]
Identifier (BE): 1 (0x0001)
Sequence number (BE): 844 (0x034c)
Data (32 bytes)

ICMP Echo Reply

# ICMP reply packet
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0x520f [correct]
Identifier (BE): 1 (0x0001)
Sequence number (BE): 844 (0x034c)
Response time: 29.905 ms
Data (32 bytes)

ICMP Purpose

ICMP serves two main functions:

• Error reporting: Notifies about network issues
• Query messages: Used in diagnostic tools like ping