wireshark过滤条件

过滤条件

tcp.port == 80 and ip.src == 192.168.2.1

ip.addr ne 192.168.4.1

not ip.addr eq 192.168.4.1

1display 过滤条件

1.1比较操作符

比较操作符能够写成类似C语言或者英语样式

eq, == Equal

ne, != Not Equal

gt, > Greater Than

lt, < Less Than

ge, >= Greater than or Equal to

le, <= Less than or Equal to

1.2逻辑操作符

逻辑操作符能够写成类似C语言或者英语样式

and, && Logical AND

or, || Logical OR

not, ! Logical NOT

1.3表达式

ip.src==10.40.43.164 && ip.dst==10.40.113.60) || (ip.dst==10.40.43.164 && (ip.src==10.40.113.60 && tcp.port==8080))

指定ip地址

ip.addr==10.40.42.204 !(ip.addr==10.40.43.164 ) !(ip.addr != 10.40.43.164 )

ip.src==10.40.43.164 ip.dst==10.40.113.60 ip == 10.42.109.153

指定源端或者目的端ip地址

ip.src == 10.40.43.164

ip.dst == 10.40.113.60

指定端口

tcp.port == 8080 tcp.srcport==500 tcp.dstport == 200

指定协议类型以及相关字段

http.request.method == "POST"

http contains "https://www.360docs.net/doc/831788870.html,";

http or tcp 显示http或tcp协议

2capture过滤条件

2.1比较操作符

比较操作符能够写成类似C语言或者英语样式

eq, == Equal

ne, != Not Equal

gt, > Greater Than

lt, < Less Than

ge, >= Greater than or Equal to

le, <= Less than or Equal to

2.2逻辑操作符

逻辑操作符能够写成类似C语言或者英语样式

and, && Logical AND

or, || Logical OR

not, ! Logical NOT

指定ip: host 192.168.0.1

指定协议类型: tcp , upd

指定

指定端口: [ dst, src] port 80 ,

捕捉到指定ip的tcp协议: tcp and [ dst, src] host 10.42.109.153