This is one of the main advantages of using Wireshark.
It's clean simple style to display filtered packets.
Wireshark display filters help filter out the matching packets and limit the number of packets displayed
on a live capture or while analyzing a file with captured packets.
Display filters are different from capture filters, and the syntax is slightly different and simpler
than the capture filter.
So to apply display filter, let's first start with the wireshark here.
So the wireshark.
And that's it.
Now we will select the zero here.
Let's actually make increase the font size a little bit.
And now let's enter our hidden passwords.
Right?
Admin and password and Wireshark will capture it while password is active.
That's it.
Now we can stop the capturing here because we firstly, we will use the display filter here.
So display filters are different from capture filters and the syntax is slightly different but simpler
than capture filters.
So to apply a display filter, simply you can add the filter text in the display filter box.
And as you can see, it's written highlighted that it apply a display filter and you after writing your
filter filter command, you can enter press the enter key or you can also apply for in on this button
here.
So when the display filter is removed from the filter box, all packets are shown here.
So it display filter can filter matching on a protocol type or a specific fields in the protocol.
Also, the filter can use logical, logical comparison operators and parentheses to create complex expressions.
So now we will.
We can only display this.
We can also use ARP or ICMP.
With this, we can select the packets of Type ARP or ICMP.
Now we will apply some filter, which is a IP dot, and as you can see, it shows actually pretty much
every filters or every commands when you enter some key.
And here we will a IP address and here to equal to sign after that 192168 13.
And.
One for two here because one for two is our.
Uh, this website's IP address.
And then you can click on this button or press enter.
With this.
Here we are only displaying the packets.
That's from the IP version, host of this IP here.
So what this does is when you apply this filter in Wireshark, it will only display network packets
that have the this IP address and it ends with 142 either as the source or destination IP address.
And in other words, it filters out all the other network traffic and shows only packets associated
with this IP address.
So this type of filter can be useful in various scenarios.
For example, if you are troubleshooting network connectivity issues or monitoring network traffic from
a specific device, you can use this filter to focus on the packets exchanged with a particular IP address
and it allows you to isolate and analyze the network traffic associated with the specific device or
endpoint.
Here we just have number of packets one, 234, 568, nine.
That element.
14.
Yeah, it's 14 packets.
Started from number 13 to 51.
And we also have the SK, ip, sk here, ip.sk.
But not to this means in expressions if you know programming slightly.
This is the kind of expression that this means.
Yes, and this means not to.
That doesn't match with this IP address.
And here we will do six, eight, 13 4142.
And here now we are displaying.
Another filter is packets.
So this not equal to operator.
So ternary and equal to operator means actually not equal to.
And after that we are entering the specific IP address that we want to exclude.
Right?
So when you apply this filter in Wireshark, it will show all the network packets except Dos that have
the IP address of this here that ends with 142.
So it will show all network packets except that IP address.
In other words, it filters out all the packets originating from that particular IP address and displays
the rest of the network traffic.
So this filter can be useful in scenarios where you want to focus on analyzing network traffic, but
exclude packets coming from a specific device or source IP address.
And it allows you to narrow down your analysis to the packets that do not originate from the specified
IP address.
And remember, the Wireshark provides a wide range of filtering options, allowing you to specify multiple
criteria and combine filters to meet your specific needs.
And we also have another filter named IP address, but in a slightly different way.
Here.
Let's write it down here.
So IP.
Let's delete this iPad here means address 192168.
13.0 and 24.
This is if you remember that from previous lecture there's actually subnet mask.
This means.
This will list all the IP address, all the possible IP addresses.
Filter out all the possible IP addresses from 0 to 255.
Now let's apply this filter by entering.
Pressing.
Enter.
That's it.
IP address two point.
13 or.
Here.
Now, we will enter that IP address again.
IP address here.
Address here starts with 19192168..
13.0 and 24.
Now here.
We are cops.
We need to use two equal signs.
Sorry.
That's it.
And here with this.
That's it.
We are applying this filter in Wireshark because it will capture and display network packets that have
source or destination IP addresses with the specified subnet.
So it allows you to focus on the network traffic occurring with that particular subnet here.
So this filter can be useful in various situations as well, such as monitoring or troubleshooting network
traffic within a specific network segment or identifying communication patterns with a particular subnet.
In this case, it will, as I said, it will filter out the packages from zero.
That IP addresses that from ends with 0 to 255.
And we also lastly in this lecture, this is a beginner lecture.
We also have TCP port here or TCP port here of 80 or UDP port.
UDP port.
Eight.
And this TCP, TCP port 80 or UDP port equal equal 80 in Wireshark is used to capture and display network
packets that have either TCP or UDP traffic on Port 80.
So here this the first comment here, um, the filters packets that have TCP traffic on port 80.
So port 80 is the default port for Http hypertext transfer protocol traffic.
And this port is commonly used for web browsing.
And this over here is a logical operator that allows combining multiple filter conditions, which in
this case we combined UDP and TCP and UDP port equal equal 80.
This filters the packets that have UDP traffic on port 80.
UDP user datagram protocol is another transport protocol that can be used for various applications and
port 80 is sometimes used for non-standard UDP services.
So when you apply this filter in Wireshark, it will capture and display network packets that are either
TCP or UDP packets on Port 80.
So this can be useful when you want to specifically focus on Http or other other protocols that may
use port 80.
You can also change this port to 443 or whatever the port you want to filter out.
So and as I said, it's worth mentioning that you can modify this filter or combine it with other filters
to capture packets based on different criteria such as specific source or destination IP addresses,
protocols, packet types, etcetera.
So Wireshark provides a wide range of filtering options to meet various analysis requirements.