Wireshark Cheat Sheet

Wireshark is a powerful network protocol analyzer that allows users to capture and analyze network traffic. In this article, we will explore some of the key features and commands used in Wireshark.

One of the most useful features of Wireshark is its ability to display packets in ASCII format. To do this, you can use the `tcpdump` switches `-n` and `-A`. The `-n` switch tells Wireshark not to resolve hostnames or IP addresses, while the `-A` switch tells it to display each packet (minus its link-level header) in ASCII.

Filtering is another important feature of Wireshark. You can use filter expressions to select specific packets based on a variety of criteria. For example, you can filter by destination IP address or hostname using the `dst` keyword, or by source or destination MAC address using the `mac` keyword.

Here are some examples of how you can use filter expressions in Wireshark:

* Filter by destination IP/hostname: `127.0.0.1`

* Filter by source or destination = 127.0.0.1

* Filter by destination MAC: `01:23:45:AB:CD:EF`

* Filter by source or destination MAC: `01:23:45:AB:CD:EF`

* Filter by source network location: `127.0.0.1`

* Filter by destination network location: `127.0.0.1`

* Filter by source or destination port = 80

* Filter by source port value between 80 and 400

* Filter by destination port value between 80 and 400

* Filter by source or destination port value between 80 and 400

* Filter by IPv6 destination hostname: `mywatch`

* Filter by source or destination port = 22

You can also combine filter expressions using logical operators such as `and`, `or`, and `not`. For example, you can use the following filter expression to capture packets from both TCP ports 80 and 22:

`tcp port 80 or tcp port 22`

Wireshark also allows you to analyze saved packet capture files. To do this, simply open the file in Wireshark using the 'File' menu.

In addition to its filtering capabilities, Wireshark also includes a variety of other features that make it a powerful tool for analyzing network traffic. For example, you can use Wireshark to capture data packets from all interfaces on your system using the `sudo` command.

Here are some examples of how you can use Wireshark to capture data packets:

* Capture packets from all interfaces: `tcpdump -i any`

* Capture packets from a specific interface: `tcpdump -i eth0`

You can also use Wireshark to read and analyze saved capture files. To do this, simply open the file in Wireshark using the 'File' menu.

Overall, Wireshark is a powerful tool that allows you to capture and analyze network traffic with ease. Its filtering capabilities, packet display options, and ability to analyze saved capture files make it an essential tool for anyone who needs to troubleshoot or analyze network issues.

Download Wireshark Cheat Sheet and more Cheat Sheets

For more information on how to use Wireshark, you can download the official Wireshark cheat sheet from the Wireshark website. You can also find additional cheat sheets on the Docsity website.

Wireshark Cheat Sheet Adresses

Here are some key addresses that you may need to reference when using Wireshark:

* MAC address: `01:02:03:04:05:06`

* IP address: `10.1.1.1`

* IP address range: `10.1.1.0/24`

Wireshark Cheat Sheet Operators

Here are some key operators that you can use in Wireshark filter expressions:

* Logic:

+ eq or = and or &

+ ne or != or or || Logical OR

+ gtor> xor or ““ Logical XOR It or =

* Substring operator: `le or <=`

* Ethernet ARP: `eth arp eth.addr _mac eth.src _mac eth.dst src.proto_ipv4 _ipv4 WLAN (802.11) IPv4 wlan ip wlan.addr ip.addr wlan.ra //receiver address ip.sre wlan.ta //transmitter address ip.dst wlan.da //destination address wlan.sa //source address wlan.fc.type wlan.fc.type_subtype wlan.bssid wlan.aid //association id`

* High Layer Protocols: `bootp, dns, ftp, http (thbasic, thorization ), imap, ldap, nfs, pop, rip, sip, smb, smtp, ssh, telnet, tftp`