[Haifux] WireShark lecture - Some additional details.
anir at research.haifa.ac.il
Tue Jun 17 18:42:39 MSD 2008
Thank you for listening to me again. I hope I didn't bore some people too
I include, below a list of very useful filters (display and capture).
Note1: display filters can be changed "on the fly" even while capturing,
if your machine is fast enough. (here "fast" depends greatly on WHAT is
capture filters cannot be changed without stop and start.
Note2: in the capture panel there is an option "update packets in real
time". If capturing very fast traffic fails, this can be disabled.
I mentioned that real-time-display is a great option, but if all else
fails, you can try without it.
Note3: coloring rules can be saved. I strongly suggest to use coloring and
to save the rules, it helps a lot to understand (at the begining).
Look at the links I supplied last time (see below) - its worth it.
Last note, and thanks to those who send me traces of their adsl or cables
connection : Thank you all. I am going to miluim tomorrow, so, understand
---------- Forwarded message ----------
Date: Mon, 7 Apr 2008 18:03:22 +0300 (IDT)
From: Nir Abulaffio <anir at research.haifa.ac.il>
To: Haifux <haifux at haifux.org>
Cc: linux-il <linux-il at cs.huji.ac.il>
Subject: Re:How Ethernet works - Some more details
In my lecture, I mentioned that I cannot put in the lecture slides the
things I showed on screen. Some pages were from books that are in print.
I showed some pictures, that, I think, explain very well certain aspects
of ethernet communication.
However I supply, below, links to some of the information I talked about,
even if these are less good (in my opinion),
and some I didn't have time to talk about :-) ...
presentation of osi layers and other matters.
about : Ethernet over twisted pair
History, layer description, examples, and much more: worth looking at
** everybody will find something he didn't know.
tcp state machine :
(the next link is very long and split on 6 lines !).
-- Wireshark filters --
Here are a few examples of diplay filters and capture filters.
In both cases logical expressions can do wonders.
eth.dst == 00:0d:22:23:62:3f (filtering based on MAC address).
ip.src == 126.96.36.199
!(ip.src == 188.8.131.52) (negation this way works, using != doesn't always)
!(ip.addr == 184.108.40.206 or ip.addr==220.127.116.11)
!(tcp.srcport == 80)
!(tcp.port == 80)
arp (worth trying)
CAPTURE filters : (spaces between keywords are important)
ether host 00:0d:22:23:62:3f
net 18.104.22.168 mask 255.255.255.0 (note: non-netwok bits should be set to zero)
net 22.214.171.124 mask 255.255.255.252
tcp port 8080
More information about the Haifux