Cheat sheet

Network filters

Two syntaxes not to mix up: BPF filters at capture time (tcpdump, and Wireshark at start-up); Wireshark and tshark display filters filter when reading. The analysis approach is in Network Traffic Analysis.

CJCADefence

BPF and Wireshark side by side

I want…	BPF (capture)	Wireshark (display)
One host	`host 10.0.0.5`	`ip.addr == 10.0.0.5`
One source	`src host 10.0.0.5`	`ip.src == 10.0.0.5`
A network	`net 10.0.0.0/24`	`ip.addr == 10.0.0.0/24`
A port	`port 443`	`tcp.port == 443`
Destination port	`dst port 445`	`tcp.dstport == 445`
A protocol	`icmp`, `udp`, `arp`	`icmp`, `dns`, `http`
Exclude	`not port 22`	`!(tcp.port == 22)`
Combine	`host A and port 80`	`ip.addr == A && tcp.port == 80`
SYN only	`'tcp[tcpflags] == tcp-syn'`	`tcp.flags.syn == 1 && tcp.flags.ack == 0`

Useful display filters for analysis

Filter	Shows
http.request.method == "POST"	Form and data submissions
http.authorization	HTTP Basic authentication (base64 credentials)
ftp \|\| telnet	Cleartext protocols
dns.qry.name contains "x"	DNS queries containing a word
dns.qry.type == 16	DNS TXT queries
tls.handshake.extensions_server_name	Domain names visited over HTTPS (SNI)
smb2	Modern SMB traffic
kerberos	Kerberos exchanges
arp.duplicate-address-detected	One IP announced by two MAC addresses
tcp.analysis.flags	TCP retransmissions and anomalies
frame contains "admin"	Packets containing a string

tcpdump options

Option	Effect
-i	Listening interface (-D to list them)
-nn	Resolves neither hostnames nor ports
-w / -r	Write to / read from a pcap file
-A / -X	Content as ASCII / as hex and ASCII
-c	Stop after N packets
-s 0	Capture whole packets
-v / -vv	More detail

tshark

# Display filter and selected fields
tshark -r capture.pcap -Y 'http.request' -T fields -e ip.src -e http.host -e http.request.uri
# TCP conversation statistics
tshark -r capture.pcap -qz conv,tcp
# Protocol hierarchy
tshark -r capture.pcap -qz io,phs