🦈 Wireshark Useful Filters – Quick Guide for Network Pros 🌐
Wireshark is the go-to tool for packet analysis 📡. With the right filters, you can cut through the noise and find exactly what matters 🔎. Here are some of the most useful ones every cybersecurity pro 🛡️ and network engineer ⚙️ should know:
✨ Host & IP Filters
ip.addr == 192.168.1.10 → traffic from/to one host 🖥️
ip.src == 10.0.0.5 → packets from a source 📤
ip.dst == 8.8.8.8 → packets to a destination 📥
✨ Protocol Filters
http → all HTTP traffic 🌍
dns → DNS lookups & responses 🔤
tcp / udp → filter transport layer 📡
✨ Port Filters
tcp.port == 443 → HTTPS 🔒
udp.port == 53 → DNS 📡
tcp.port == 22 → SSH 🔑
✨ Conversation Tracking
tcp.stream eq 5 → follow a single TCP session 🔄
http.request → show only client requests 📤
http.response → show only server responses 📥
✨ Error & Suspicious Activity
tcp.flags.reset == 1 → connection resets ⚠️
icmp → ping/echo packets 🛰️
ssl.handshake → TLS handshakes 🔐
⚠️ Disclaimer:
For educational & authorized use only. Always analyze traffic in labs or systems you manage. 🚫🔒
#Wireshark #PacketAnalysis #CyberSecurity #InfoSec #NetworkSecurity #BlueTeam #NetworkTraffic #TechTools 🦈