wiresharknotes
Table of Contents
WireShark
Summary: How to work with wireshark.
Date: 3 January 2025
Trace in Linux
tcpdump -w /tmp/tracefile
You can end the trace using <ctrl> + c, after which you can open the file using wireshark.
Display Filters
- Only IP-address 10.10.10.10
- ip.addr == 10.10.10.10
- Everything except IP-address 10.10.10.10
- !(ip.addr == 10.10.10.10)
- Everything except DNS and NTP
- !(udp.port == 53) and !(udp.port == 123)
wiresharknotes.txt · Last modified: by 127.0.0.1