Wireshark filter for filtering both destination-source IP address and the protocol

Mastering Wireshark: Filtering by Source/Destination IP and Protocol

Learn how to effectively use Wireshark display filters to pinpoint network traffic based on both source/destination IP addresses and specific protocols, enhancing your network analysis and troubleshooting skills.

Wireshark is an indispensable tool for network administrators, security professionals, and developers alike. Its ability to capture and analyze network traffic provides deep insights into network behavior. However, raw packet captures can be overwhelming. This article focuses on a crucial aspect of Wireshark's power: display filters. Specifically, we'll explore how to combine filters for both source/destination IP addresses and protocols to efficiently isolate the traffic you need to examine.

Understanding Wireshark Display Filters

Wireshark uses a powerful display filter language that allows you to narrow down the vast amount of captured data to only the packets relevant to your investigation. Unlike capture filters, which discard packets before they are even saved, display filters hide packets from view after they have been captured. This means you can always go back and apply different filters to the same capture file without losing any data.

flowchart TD
    A[Start Wireshark Capture] --> B{Raw Packet Data Collected}
    B --> C[Apply Display Filter]
    C --> D{Filter Matches?}
    D -- Yes --> E[Packet Displayed]
    D -- No --> F[Packet Hidden]
    E --> G[Analyze Displayed Packets]
    F --> G

Wireshark Capture vs. Display Filter Workflow

Filtering by IP Address: Source and Destination

Filtering by IP address is fundamental. Wireshark provides specific keywords to target source (ip.src) and destination (ip.dst) IP addresses. You can also use the generic ip.addr to match an IP address regardless of whether it's the source or destination.

ip.src == 192.168.1.100
ip.dst == 10.0.0.5
ip.addr == 172.16.0.1

Basic IP address filters in Wireshark

Filtering by Protocol

Wireshark recognizes hundreds of protocols, and you can filter by their common abbreviations. For example, to see only HTTP traffic, you'd use http. For DNS, it's dns, and so on. You can also filter by protocol layers, such as tcp or udp.

http
dns
tcp
udp

Basic protocol filters in Wireshark

Combining IP Address and Protocol Filters

The real power comes from combining these filters using logical operators like and (&&), or (||), and not (!). This allows you to create highly specific filters to isolate exactly the traffic you're interested in. The most common scenario is to look for a specific protocol's traffic to or from a particular IP address.

# Filter HTTP traffic where the source IP is 192.168.1.100
ip.src == 192.168.1.100 and http

# Filter DNS traffic to or from 10.0.0.5
ip.addr == 10.0.0.5 and dns

# Filter TCP traffic between 192.168.1.100 and 10.0.0.5
(ip.src == 192.168.1.100 and ip.dst == 10.0.0.5 and tcp) or \
(ip.src == 10.0.0.5 and ip.dst == 192.168.1.100 and tcp)

# A more concise way to filter traffic between two IPs for a specific protocol
(ip.addr == 192.168.1.100 and ip.addr == 10.0.0.5) and tcp

Examples of combined IP and protocol filters

Practical Examples and Use Cases

Let's look at some common scenarios where these combined filters are invaluable.

1. Troubleshooting a Web Server

To see all HTTP traffic involving your web server at 192.168.1.50, you would use: ip.addr == 192.168.1.50 and http

2. Investigating a Specific Client's DNS Queries

If a client machine 192.168.1.10 is having DNS resolution issues, you can isolate its DNS traffic with: ip.addr == 192.168.1.10 and dns

3. Analyzing SSH Connections to a Server

To monitor SSH traffic (port 22) to a server 10.0.0.100, you could use: ip.dst == 10.0.0.100 and tcp.port == 22 or ip.dst == 10.0.0.100 and ssh (if Wireshark identifies it as SSH).

4. Filtering for specific HTTP requests from a client

To see HTTP GET requests from 192.168.1.100: ip.src == 192.168.1.100 and http.request.method == "GET"

By mastering these filtering techniques, you can significantly reduce the time spent sifting through irrelevant data in Wireshark, allowing you to focus on the packets that truly matter for your analysis or troubleshooting task. Experiment with different combinations and explore Wireshark's extensive filter capabilities to become a more efficient network analyst.