To find TCP traffic truly sourced from your network, try:Ĭontry.dst = 'ukraine' & direction = 'outbound' & tcpflags = 'syn' & tcpflags = 'ack'

which would show up backwards, making it look like YOU were initiating traffic, when in fact it's being initiated from Ukraine. You will want to look at 'tcpflags' meta and see if there is a large imbalance between the 'ack' count and the 'syn' count, if there are way more 'ack' instances, then some of those may be from an 'ack scan' sourced from a Ukraine IP range. I understand, but you nee to quantify that data after the carve.

Hope this is helpful for everyone and as always, Happy Hunting! Show all http with content-type='image/gif' § Wireshark Service=80 & content ='image/gif','image/jpeg','image/png','image/etc' Show all http with content-type='image/(gif|jpeg|png|etc)' § Wireshark Service=80 & content contain 'javascript' Show only filetypes that begin with 'text' Wireshark Service=80 & de !exists (200 are not explicitly captured) Service=80 & error !exists (200 are not explicitly captured) Service=80 & ( query contains 'flv' || query contains 'swf' || content contains 'flash' || content contains 'video') contains 'flv' or contains 'swf' or ntent_type contains 'flash' or ntent_type contains 'video' Here's where I pulled some additional filters for mapping: HTTP Packet Capturing to debug Apache Ip.addr = 10.43.54.65 equivalent to Wireshark SIP ) and filter out unwanted IPs: Wireshark Match HTTP requests where the last characters in the uri are the characters 'gl=se': Wiresharkįilter by a protocol ( e.g. Ip.src=192.168.0.0/16 & ip.dst=192.168.0.0/16įilter on Windows - Filter out noise, while watching Windows Client - DC exchanges Wireshark Show only traffic in the LAN (.x), between workstations and servers - no Internet: Wireshark Tcp.dstport=25 || ip.proto=1,58 -> (icmp or ipv6 icmp) Service=25 || ip.proto=1,58 -> (icmp or ipv6 icmp) Show only SMTP (port 25) and ICMP traffic: Wireshark This is where I pulled the Wireshark display filters from: DisplayFilters - The Wireshark Wiki Wireshark has been around for a long time and the display filters that exist are good reference points to learn about network (packet) traffic as well as how to navigate around various parts of sessions or streams.īelow you will find a handy reference which allows you to cross-reference many of the common Wireshark filters with their respective RSA NetWitness queries.

Wireshark filter http session