Hi, everyone! Today I’m going to introduce how to use Wireshark to capture packets.
After the software is started, the buttons in the red box are as follows from left to right:
-The list displays the network packages of all network adapters, which are seldom used.
-Display packet capture options. Generally, you can click this button to start capturing packets.
-Start new packet capture. Generally, few packets are used.
-Stop capturing packets. After you capture packets, it is stopped.
-Clear the captured packets to prevent the device from changing the card when the packet capture time is too long.
In fact, we only need to know the functions of the buttons in bold to capture packets. The rest is how to capture the data packets you want and how to analyze the problems.
In the following figure, the page for capturing packets is the second button. In the same way, only the most commonly used functions are described. In the following figure, the red box in the following figure is the network adapter to be captured, after you select a network adapter, the IP address of the network adapter is displayed.
Capture Filter is the place where packet capture rules are to be written. It is also called “ filtering rule ”. Many rules are written in this frame. After the rules are written, click Start to capture packets.
After capturing packets, if you need to analyze the captured packets, choose File > Save As to save the captured packets, as shown in the following figure.
OK, here, the basic use of the method is finished, then step into the key content.
The most common problem when Wireshark is used is that when you use the default settings, a large amount of redundant information is generated, which makes it difficult to find the required part. That's why the filter is so important. They can help us quickly find the information we need in the complex results.
Differences between filters
Capture filter (CaptureFilters): It is used to determine what information is recorded in the capture result. Set this parameter before starting capturing.
Display filter (DisplayFilters): Perform detailed search in the capture result. They can be modified at will after the capture results are obtained.
So what kind of filter should I use?
The purposes of the two filters are different.
The capture filter is the first layer of filter that data passes through. It is used to control the number of captured data to avoid large log files.
The display filter is a more powerful (complex) filter. It allows you to quickly and accurately find the required records in the log file.
If you have any problems, please post them in our Community. We are happy to solve them for you!
