[Wireshark] Filter POST requests only

http.request.method == “POST”

Reference:

• How to make wireshark filter POST-requests only?

Read More

[tcpdump] How to use tcpdump

Specific IP address
tcpdump -i eth0 host <IP's address>

Specific port
tcpdump -i eth0 port 1194

Capture port range 23 to 1023 from source.
tcpdump -i wan0 -n src portrange 23-1023

Capture port range 23 to 1023 to destination.
tcpdump -i wan0 -n dst portrange 23-1023

tcpdump -i eth0 icmp

s catch how long on each packet.
This mean to catch first 80 bytes on each packet.
tcpdump -i eth0 -s 80 -w /tmp/abc.cap

Only catch specifi ip address.
tcpdump -i eth0 host 192.168.0.1 -w /tmp/abc.cap

# tcpdump --help
tcpdump version 4.1.1
libpcap version 1.1.1
Usage: tcpdump [-aAbdDefIKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -M secret ] [ -r file ]
                [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ]
                [ -y datalinktype ] [ -z command ] [ -Z user ]
                [ expression ]

Reference:

• A tcpdump Primer with Examples
• Tcpdump usage examples

Read More

[Wireshark][Life] Wireshark Ideal

[Wireshark]


One senior student s share a book about wireshark. Let me get a interesting ideal. Maybe I can compile it into my embedded system to replace tcpdump. Put this job into my to_do_list.

If want life more abundant, need more sparkle ideal.



有一位學長分享了一本wireshark的書，讓我感到興趣。或許我可以把它編到我目前的實驗板，來取代原本的 tcpdump. 這可以列為我的 未來要做的事項。

生活要有趣，必須要有天馬行空的想像。



EBook : https://www.wireshark.org/download/docs/user-guide-us.pdf

Source Code : https://www.wireshark.org/download.html

Read More

[Wireshark] List filter method

Display Filter：[ list the condition of packet ]

eth.dst == 00:00:00:00:00:aa || eth.dst == 00:00:00:00:00:bb

host 1.2.3.4  (Source or Destination IP)

ip.addr == 1.2.3.4  ( Source or Destination IP)

ip.src == 1.2.3.4  ( Source  IP )

ip.dst == 1.2.3.4  ( Destination IP )

host 1.2.3.4 and tcp.port == 80  ( The port of web )

host 1.2.3.4 and tcp.port == 23  (BBS)

Filter http and ip
(http) and (ip.addr == 111.6.1.191)

Read More

[ubuntu][wifi sniffer] How to use wificard to sniffer the packet on the air

Type ifconfig then show ether list.

ifconfig wlan0 down;
iwconfig wlan0 mode monitor;
ifconfig wlan0 up.

If wifi interface show long mac address, then successful.



Open wireshark to monitor the packet wihich on the air.

The packet on the air will appear on the wireshark.

If Machine is on channe 3.
Please type "iwconfig wlan0 channel 3" to switch ether dongle to match machine on channel 3.
Then ether dongle will capture the packet from machine.

Read More

[wireshark][ubuntu] Wireshark can't find interface

Question : WireShark can't find interface in ubuntu.

Answer : Let WireShark have root power.

Method :

1. Using terminal. Type sudo wireshark.



2. press Alt+F2. Type gksudo wireshark.



Reference : Ubuntu - Wireshark Shows No Interfaces - eth0

Read More