Notes, Tips & Tricks: WireShark

This is a notes page, extended with tips & tricks. This page is not really documentation, just stuff for me to remember. Sometimes things will get removed from these pages and turned into real documentation, sometimes not. You might find these notes to come in hand, maybe not. For me, it's just things I don't want to forget.

tcpdump -w /tmp/tracefile

Je kan de trace beëindigen met <ctrl> + c, waarna je de file kunt openen met wireshark.

• Only IP-address 10.10.10.10
  • ip.addr == 10.10.10.10
• Everything except IP-address 10.10.10.10
  • !(ip.addr == 10.10.10.10)
• Everything except DNS and NTP
  • !(udp.port == 53) and !(udp.port == 123)