24. Traffic Sniffing and Analysis
24.4 Display Filters and Following a Stream
Wireshark che display filters (capture filters peksha vegle) je disat aahe tyatun nemka packet shodhtat.
| Filter | Shows |
|---|---|
ip.addr == 192.168.56.20 |
Any packet to or from that IP |
tcp.port == 80 |
HTTP traffic |
http |
Only HTTP packets |
http.request.method == "POST" |
Form submissions (logins!) |
dns |
DNS queries and answers |
tcp.flags.syn == 1 && tcp.flags.ack == 0 |
Connection starts (spot a port scan) |
frame contains "password" |
Any packet with that word |
Follow TCP Stream: right-click a packet, Follow, TCP Stream, and Wireshark reassembles the whole conversation into readable text – the entire HTTP request and response in one window.
Ravindra Bagale's Tip
Capture filter ani display filter vegle aahet: capture filter (tcpdump-style, port 80) capture-adhi lavla jato ani kami packets gheto; display filter (http, ip.addr==) capture-nantar disnare galto. Interview madhe ha farak vichartat. Suruvatila sagla capture kara, mag display filter ne shodha.
Lab
In Wireshark, apply http.request.method == "POST", then log in to DVWA (HTTP) from Firefox. Find the login POST, right-click, Follow TCP Stream, and read the request. You will see the username and password in plain text – proof for the next section.