In this lecture I will explain about how to walk with the white shark display filters.
But first I will add some information about how to work with capture filters that we have seen in the
previous picture.
So for example we have seen that we can use existing culture filters or add an additional one or modify
an existing one and we can also write.
If you start in this box and then save this filter and using these existing filters will help us to
save them and use them later without the need to write them again.
And there is another benefit in working with capture filters from the capture menu and then select options
which is we can apply a different capture filter for each interface.
And by choosing output we can save the culture to a permanent file and using the options tab we can
figure out when to stop capturing.
So it does now start explaining about each play filters.
I will start capturing when the wireless connection interface.
So now I will use to capture.
So if I want to focus on specific protocol for example I GMB I can type that in the display filter box
and then hit enter.
So now we see all the packets of I GMB and we can also apply specific value as a filter that is present
in the packets.
So for example I want to search for packets from this I better if I can right click on it and then select
apply as a filter and then select it so that will display packets from that IP as a source.
Or we can
use the not selected.
So for example I want to search for buckets that are not from the source IP address.
I can select what selected and we can search for a specific field in protocol so for example I want
to search in
TCB for a specific destination board for example this one I can click here and then select apply as
a filter and then select it.
So here we see that we have packets of SSL only so the destination board of 443 we see that when we
apply the filter that display filter expression was written it automatically in the display filter box.
So if we want something to help us to write those expressions we can click here and here we see that
we have many of protocols and wills and relations and values.
So for example I want to search for the buckets that have the sign plug I can go here Monday select
this one and then click on OK.
And I have to delete this picture first then click here
so now we see packets that contain only the TV sign flat.
And here in the state of Spain we see that we have 16 packets split from more than 2000 packets that
are captured and we can also use existing filters like we have seen in working with the capture filters
and we can also.
Would you find existing ones or add new ones.
And you can also reach the same dialog box from the analyzed menu and then display filters
and we hear in this packet we see that we have
name resolution for the organization part of the MAC address.
So name resolution is enabled by default in wire shark and we can change the settings of that by going
to the Edit menu and then preferences and then name resolution.
So we see that any resolution is enabled for mac addresses but not for the IP addresses and recommended
to turn that off for hosts or IP addresses because that can degrade the performance of a white shark
or fail to work correctly or also will inject some traffic into a network of DNS that can interfere
with your actual traffic.
So in this lecture I have explained different ways of working with the wire shark display filters and
in the next lecture I will explain about working with the colouring rules and how to save captures.