Editing Networking (section)

== Wireshark and related stuff ==

[https://www.wireshark.org/docs/ Wireshark docs]

[https://www.wireshark.org/docs/man-pages/ Wireshark Manual (man) pages]

[https://www.wireshark.org/docs/man-pages/editcap.html editcap man page]

[https://wiki.wireshark.org/CaptureFilters Capture Filters]

=== Capture filter examples ===

Filter by destination IP address <code>dst host x.x.x.x</code>

Filter by a set of TCP ports <code>tcp port 22 or tcp port 443 or tcp port 8080</code>

Filter by TCP/UPD port <code>port 5060</code>

=== Display filter examples ===

Filter out TCP Keep-Alive and TCP Keep-Alive ACK with this filter:

<code>!(tcp.flags.ack && tcp.len <=1)</code>

Filter by port 442 and remove TCP Keep-Alive and TCP Keep-Alive ACK with this filter:

<code>tcp.port == 443 && !(tcp.flags.ack && tcp.len <= 1)</code>

=== Add custom columns ===

Add TCP length column to Wireshark

[[File:Tcp.len.png|border|TCP length column]]

=== tshark ===
Export from network capture all TCP payloads using a display filter as octet stream (ASCII hex stream)

<pre>tshark -r <file_name> -Y "ip.src==192.168.1.100 && tcp.port==22222" -T fields -e data > output_file_name.txt</pre>

=== Editcap ===

Reference [https://www.wireshark.org/docs/man-pages/editcap.html editcap man] page

Saves only packets whose timestamp is on or after start time. The time is given in the following format YYYY-MM-DD HH:MM:SS.

Example of timestamps after 2018-12-26 00:00:00 using PowerShell:
<pre>& 'C:\Program Files\Wireshark\editcap.exe' -A "2018-12-26 00:00:00" infile outfile</pre>

Example to limit capture file from frame number 890000 to 910000 (inclusive) using PowerShell:

<pre>& 'C:\Program Files\Wireshark\editcap.exe' -r infile.pcap smallerOutFile.pcap 890000-910000</pre>

'''Note: smallerOutFile.pcap in above example will have different frame numbers (counting starts over when you open file).'''