24. Traffic Sniffing and Analysis
24.4 Display Filters and Following a Stream
Wireshark che display filters (capture filters peksha vegle) je disat aahe tyatun nemka packet shodhtat.
| Filter | Shows |
|---|---|
ip.addr == 192.168.56.20 |
Any packet to or from that IP |
tcp.port == 80 |
HTTP traffic |
http |
Only HTTP packets |
http.request.method == "POST" |
Form submissions (logins!) |
dns |
DNS queries and answers |
tcp.flags.syn == 1 && tcp.flags.ack == 0 |
Connection starts (spot a port scan) |
frame contains "password" |
Any packet with that word |
Follow TCP Stream: right-click a packet, Follow, TCP Stream, and Wireshark reassembles the whole conversation into readable text – the entire HTTP request and response in one window.
Ravindra Bagale's Tip
A capture filter and a display filter are different: a capture filter (tcpdump-style, port 80) is applied before capturing and takes in fewer packets; a display filter (http, ip.addr==) filters what is shown after capturing. Interviewers ask about this difference. At first, capture everything, then search with a display filter.
Ravindra Bagale's Tip – मराठी
Capture filter आणि display filter वेगळे आहेत: capture filter (tcpdump-style,port 80) capture आधी लावला जातो आणि कमी packets घेतो; display filter (http, ip.addr==) capture नंतर दिसणारे packets गाळतो. Interview मध्ये हा फरक विचारतात. सुरुवातीला सगळे capture करा, मग display filter ने शोधा.
Ravindra Bagale's Tip – हिंदी
Capture filter और display filter अलग हैं: capture filter (tcpdump-style,port 80) capture से पहले लगता है और कम packets लेता है; display filter (http, ip.addr==) capture के बाद दिखने वाले packets छाँटता है. Interview में यह फ़र्क पूछते हैं. शुरुआत में सब capture करो, फिर display filter से ढूँढो.
Lab
In Wireshark, apply http.request.method == "POST", then log in to DVWA (HTTP) from Firefox. Find the login POST, right-click, Follow TCP Stream, and read the request. You will see the username and password in plain text – proof for the next section.