Wireshark is an incredible tool to analyze network traffic.
Capture filtering
See CaptureFilters. Syntax is different from display filters.
To avoid big memory use, prefer filtering when capturing.
Use and
or
not
and parenthesis to combine filters.
Typical filters are:
tcp and port 80
udp and (port 8000 or port 8002)
host 232.128.12.3
igmp
icmp
Display Filter
See DisplayFilters. Syntax is different from capture filters.
They can be created from packets : select a packet, right-click, and select as filter.
Typical filters are :
ip.addr==192.168.1.12
tcp.port==80
tcp.flags.push==1
vlan && udp
_ws.expert.severity
select packets with a detected error
Decoding
To choose a decoder, right-click on one packet, and choose "Decode as...".
Then select the field that will select the dissector (TCP port, UDP port, RTP payload type, ...), choose the value, and select the decoder in Current column.
Choose Save to keep the changes for next launch.
Adding dissectors
A dissector is a protocol analyzer. It can be written in LUA.
You can put your lua scripts in
- Linux:
$HOME/.config/wireshark
- Windows:
%AppData%\Wireshark\plugins
or%ProgramFiles%\Wireshark\plugins
(folders are shown in Help–>About Wireshark–>Folders)
For Linux, you need to add a init.lua
script that will load them with dofile("myfile.lua")
, in Windows it loads all present in the folder.
In recent versions of Wireshark, LUA bitop can be used directly.
Useful dissectors
ST2026
Select the "RTP Payload type" to ST2022-6
for ProMPEG FEC.
The stream must be first decoded as RTP.
ULP-FEC (RFC 5109)
Select the "RTP Payload type" to ULPFEC
for RFC 5109 FEC.
The stream must be first decoded as RTP.
MPEG-TS Dump
Use Tools->Dump MPEG TS Packets to export the MPEG-TS stream to a file.
UltraVox 2.1 (Shoutcast 2)
For TCP stream, use UVOX21
.
ADTS
For UDP/TCP stream, use ADTS
.