Wednesday, April 15, 2020

wireshark Filter


Find IPV4 MAC address for DHCP
bootp.hw.mac_addr ==XX:XX:XX:XX:XX:XX
Find IPV6 MAC address for DHCP
dhcpv6.duidll.link_layer_addr == “XX:XX:XX:XX:XX:XX”
Find DNS Qeuery:
dns.qry.name == “XXX.XX.com”
Filter specific IP address overnight or many days. 
If you used above method, your PC might hang. Basely above capture all the packet and just filter. But this is not the best way if you want to capture many hours.  

In order to solve this problem, you have to just capture you wanted packet, it will not capture other packet. 
capture>options>capture filter>type your target to filter(ex: host xxx.xxx.xxx.xxx && udp port=XX)



 


















No comments:

Post a Comment