Network administrators encounter a wide range of network problems while doing their jobs. Whenever there is a suspicious action or a need to evaluate a particular network segment, protocol analysis tools like Wireshark can come in handy. A particularly useful feature is filtering network packets by IP addresses.
If this is your first time using it, you may find it a little difficult to set up the steps to do it on your own. Luckily, we’ve put together this ultimate guide on how to filter by IP in Wireshark. You’ll walk away knowing the difference between your two filtering languages, learning new filter strings, and much more.
The best thing is that you will only need help to perform these steps the first time. Every next performance will be a piece of cake!
What is Wireshark?
Wireshark is a network packet analyzer that has been dominating the industry space for quite some time. It’s been fantastic to the point of neglecting many similar tools, including Microsoft Network Monitor. The two main features that made Wireshark famous are its flexibility and ease of use.
Network packet analyzers are tools that capture and analyze data traffic in the greatest possible detail on specific communication channels. They serve as definitive diagnostic tools for embedded systems.
Wireshark comes with top-notch capability to filter packets during capture and analysis with different levels of complexity. This makes it equally suitable for both beginners and network monitoring professionals. Wireshark also ingests and analyzes traffic from several other protocol analyzers, making it easy to review previous traffic at specific points.
Before Wireshark, network monitoring tools tended to be very expensive or proprietary. All that changed with the arrival of this application. The software is open source and compatible with all major platforms. This gave Wireshark a lot of community support, removing cost as a barrier and leaving room for a wide range of training opportunities.
Here’s why people may want to use Wireshark:
- Network troubleshooting
- Examine security issues
- Browse network applications
- Debugging Protocol Implementations
- Learn about the internals of the network protocol
Wireshark is free to download. In case you haven’t done it yet, you can do it. here. Simply download the executable and click on the file to install it.
The Wireshark User Interface
After downloading and installing Wireshark, you can access it from your local shell or window manager. One of the first things you need to do is choose a network interface from the list of networks on your computer’s adapters.
You can click Captureso Interfaces in the menu and choose the appropriate option.
The main window of the Wireshark interface consists of several parts:
- Menu – used to start actions
- Main Toolbar: Quick access to frequently used items from the menu
- Filter Toolbar: You can set display filters here
- Packet List Panel – Captured Packet Summaries
- Details panel: More information about the selected packet from the packet lane
- Byte Panel: Package data from the package list panel, highlighting the chosen field in that panel
- Status bar: captured data and current program status information
You can control package lists and navigate details completely with your keyboard. There is a table showing common keyboard shortcut commands. here.
How to add filters in Wireshark?
He Filter The toolbar is where you can customize and launch new display filters.
To create and edit capture filters, go to Manage capture filters from the favorites menu or navigate to Captureso Capture filters from the main menu.
To create and edit display filters, select Manage display filters from the favorites menu or go to the main menu and select Analyzeso Display filters.
You will see a filter input section with a green background. This is the area where you enter and edit display filter strings. This is also where you can see the currently applied filter. Simply click the filter name or double-click the string to edit it.
While you are typing, the system will perform a system check of the filter chain. If you enter an invalid one, the background changes from green to red. Always hit the Apply button or the Get into key to apply the filter string.
You can add a new filter by clicking the Add button, which is a black plus sign on a light gray background. Another way to add a new filter is to right-click on the filter button area. To remove a filter, click the minus button. The minus button will be grayed out if no filter is selected.
How to filter by IP address in Wireshark?
A great feature of Wireshark is that it allows you to filter packets by IP addresses. Simply follow the steps below for instructions on how to do it:
- Start by clicking the plus button to add a new display filter.
- Perform the following operation in the Filter box: address.ip==[IP address] and hit Get into.
- Note that the packet list lane now only filters traffic going to (destination) and from (source) the IP address you entered.
- To clear the filter, click the Clear on the Filter toolbar.
source IP
You can restrict viewing packets to those with particular source IP addresses that appear in that filter. Just run the following command in the filter box and press Get into:
ip.src == [IP address]
destination IP
You can apply destination filters to restrict the viewing of packets to those with a specific destination IP shown in the filter.
The command is the following:
ip.dst == [IP address]
Capture Filter vs. View Filter
Wireshark supports two filtering languages: capture filters and display filters. The first one is used for filtering while capturing packets. These last filters showed packets. With display filters, you can focus on the packages you are interested in and hide those that are not currently important. You can display packages based on several factors:
- Protocol
- Presence in the field
- Field values
- Comparison of fields
Display filters use a Boolean operator syntax and fields that describe the packets you are filtering. Once you create some display filters, it will be easy to write them. Capture filters are a little less intuitive because they are cryptic.
Below is an overview of the features and uses of each filter:
Capture filters:
- They are configured before starting to attract traffic.
- Unable to change during traffic capture
- It is used to capture specific types of traffic.
Display filters:
- Reduce packets displayed in Wireshark
- It can be customized during traffic capture.
- It is used to hide traffic and evaluate specific types of traffic.
To learn more about filtering during capture, visit this page.
Additional FAQs
How do I filter Wireshark by URL?
You can search for particular HTTP URLs in the capture in Wireshark using the following filter string:
http contains “[URL]. “
Please note that you cannot use the contains operators on atomic fields (numbers, IP addresses).
How do I filter Wireshark by port number?
You can use the following command to filter Wireshark by port number:
Tcp.port eq [port number].
How does Wireshark work?
Wireshark is a network packet sniffing tool. Analyzes network packets using an Internet connection and recording the packets traveling through it. It then provides users with information about those packets, including their source, destination, content, protocols, messages, etc.
Becoming 007 in network sniffing
Thanks to Wireshark, network engineers and administrators no longer have to worry about missing out on diagnostic tools for essential network problems. The program’s convenient and easily accessible features make it much easier to assess network vulnerabilities and troubleshoot problems.
After reading our article, you should now be able to tell the difference between different filter options in the program related to IP filtering. You also learned basic string expressions for filtering by IP and much more. Hopefully this will help resolve any network issues you may encounter.
What other features do you often use in Wireshark? What do you think makes Wireshark stand out from the competition? Share your thoughts in the comments section below.
