[Haifux] WireShark lecture - Some additional details.

Nir Abulaffio anir at research.haifa.ac.il
Tue Jun 17 18:42:39 MSD 2008

Thank you for listening to me again. I hope I didn't bore some people too
I include, below a list of very useful filters (display and capture).
Note1: display filters can be changed "on the fly" even while capturing,
if your machine is fast enough. (here "fast" depends greatly on WHAT is
being captured.
capture filters cannot be changed without stop and start.
Note2: in the capture panel there is an option "update packets in real
time". If capturing very fast traffic fails, this can be disabled.
I mentioned that real-time-display is a great option, but if all else
fails, you can try without it.
Note3: coloring rules can be saved. I strongly suggest to use coloring and
to save the rules, it helps a lot to understand (at the begining).

Look at the links I supplied last time (see below) - its worth it.

Last note, and thanks to those who send me traces of their adsl or cables
connection : Thank you all. I am going to miluim tomorrow, so, understand
my silence.

---------- Forwarded message ----------
Date: Mon, 7 Apr 2008 18:03:22 +0300 (IDT)
From: Nir Abulaffio <anir at research.haifa.ac.il>
To: Haifux <haifux at haifux.org>
Cc: linux-il <linux-il at cs.huji.ac.il>
Subject: Re:How Ethernet works - Some more details

In my lecture, I mentioned that I cannot put in the lecture slides the
things I showed on screen. Some pages were from books that are in print.
I showed some pictures, that, I think, explain very well certain aspects
of ethernet communication.
However I supply, below, links to some of the information I talked about,
even if these are less good (in my opinion),
and some I didn't have time to talk about :-)  ...

presentation of osi layers and other matters.


about : Ethernet over twisted pair

History, layer description, examples, and much more: worth looking at
** everybody will find something he didn't know.

tcp state machine :

(the next link is very long and split on 6 lines !).

-- Wireshark filters --
Here are a few examples of diplay filters and capture filters.
In both cases logical expressions can do wonders.

DISPLAY filters:
eth.dst == 00:0d:22:23:62:3f  (filtering based on MAC address).
ip.src ==
!(ip.src == (negation this way works, using != doesn't always)
!(ip.addr == or ip.addr==
!(tcp.srcport == 80)
!(tcp.port == 80)
arp   (worth trying)

CAPTURE  filters : (spaces between keywords are important)
ether  host 00:0d:22:23:62:3f
net mask  (note: non-netwok bits should be set to zero)
net mask
tcp  port 8080

More information about the Haifux mailing list