Unit 7: Reading captures in Wireshark · Lesson 4 of 6 · 18 min
Display filter craft
Write precise filters with contains, matches, sets and ranges, and count with confidence.
mission
- You are
- The analyst turning hunches into filters.
- Situation
- Your notes say things like long DNS names, the scanner's hits on well-known ports, anything mentioning password. Each needs to become an exact filter.
- Goal
- Learn the operators that make display filters precise.
- Hand in
- Counts for three hunches in dns.pcap and scan.pcap.
Try the matches pattern
8a8e9bb8bdb5eba456bf92d5d98065e5751f75143a5f61de.00.t.cdn-sync.example.net intranet.corp.example 267b0bc8d3b1939a9b4ddbe45cf642b0c3a4acdd7f9fcc58.01.t.cdn-sync.example.net updates.example.org db01.corp.example
2 matches
Search inside fields with contains
contains matches a substring anywhere in a field. Combine it with the question flag to count queries, not answers.
tshark -r dns.pcap -Y 'dns.flags.response==0 && dns.qry.name contains "corp.example"' | wc -l
46
you should see 46 lookups for company names.
Match a pattern with matches
matches takes a regular expression. Here: names that start with exactly 48 hex characters and a dot.
tshark -r dns.pcap -Y 'dns.flags.response==0 && dns.qry.name matches "^[0-9a-f]{48}\\."' | wc -l
40
you should see 40 names shaped like encoded data.
Test against a set
in {a,b,c} matches any value in the set. Ranges work too: {1..1023}.
tshark -r scan.pcap -Y 'tcp.srcport in {22,80,443,8443} && tcp.flags.syn==1 && tcp.flags.ack==1 && ip.dst==203.0.113.50' -T fields -e tcp.srcport 22 443 8443 80 tshark -r scan.pcap -Y 'tcp.dstport in {1..1023} && ip.src==203.0.113.50 && tcp.flags.syn==1' | wc -l 21
you should see All four of those ports answered the scanner, and it probed 21 ports below 1024.
Search the whole packet
A protocol name on its own with contains searches every byte of that layer.
tshark -r http.pcap -Y 'http contains "password"' -T fields -e frame.number
14
you should see One frame mentions a password.
defender tip Use whole-layer searches to find leads, then switch to exact fields for the counts you report. Substring hits are easy to over-count.
Operators
| Command | What it does |
|---|---|
== != > < >= <= | Compare numbers, addresses, strings |
&& || ! | And, or, not |
contains "text" | Substring anywhere in the field or layer |
matches "regex" | Regular expression, case-insensitive by default |
in {a,b,c} / in {1..1023} | Membership in a set or range |
ip.addr == 10.20.0.0/24 | Any address in a subnet |
What a defender takes away
- 1contains for leads, matches for shapes, sets for lists.
- 2Count questions and answers separately in DNS.
- 3Write the exact filter next to every number you report.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.