User manual WIRESHARK WIRESHARK 1.4 34391

[. . . ] Wireshark User's Guide 34391 for Wireshark 1. 4 Ulf Lamping, Richard Sharpe, NS Computer Software and Services P/L Ed Warnicke, Wireshark User's Guide: 34391 for Wireshark 1. 4 by Ulf Lamping, Richard Sharpe, and Ed Warnicke Copyright © 2004-2010 Ulf Lamping , Richard Sharpe , Ed Warnicke Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. All logos and trademarks in this document are property of their respective owner. Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Defining and saving filters You can define filters with Wireshark and give them labels for later use. This can save time in remembering and retyping some of the more complex filters you use. To define a new filter or edit an existing one, select the Capture Filters. . . Wireshark will then pop up the Filters dialog as shown in Figure 6. 7, "The "Capture Filters" and "Display Filters" dialog boxes". Note! The mechanisms for defining and saving capture filters and display filters are almost identical. So both will be described here, differences between these two will be marked as such. Warning! You must use Save to save your filters permanently. Ok or Apply will not save the filters, so they will be lost when you close Wireshark. 92 Working with captured packets Figure 6. 7. The "Capture Filters" and "Display Filters" dialog boxes New This button adds a new filter to the list of filters. The currently entered values from Filter name and Filter string will be used. You can select a filter from this list (which will fill in the filter name and filter string in the fields down at the bottom of the dialog box). You can change the name of the currently selected filter here. Delete Filter Filter name: Note! The filter name will only be used in this dialog to identify the filter for your convenience, it will not be used elsewhere. You can add multiple filters with the same name, but this is not very useful. Filter string: You can change the filter string of the currently selected filter here. Display Filter only: the string will be syntax checked while you are typing. Display Filter only: This button brings up the Add Expression dialog box which assists in building filter strings. You can find more information about the Add Expression dialog in Section 6. 5, "The "Filter Expression" dialog box" Display Filter only: This button applies the selected filter to the current display and closes the dialog. Display Filter only: This button applies the selected filter to the current display, and keeps the dialog open. The file location and format is explained in Appendix A, Files and Folders. Add Expression. . . OK Apply Save 93 Working with captured packets Close Close this dialog. Defining and saving filter macros You can define filter macros with Wireshark and give them labels for later use. This can save time in remembering and retyping some of the more complex filters you use. Finding packets You can easily find packets once you have captured some packets or have read in a previously saved capture file. Wireshark will pop up the dialog box shown in Figure 6. 8, "The "Find Packet" dialog box". 6. 8. 1. The "Find Packet" dialog box You might first select the kind of thing to search for: · Display filter Simply enter a display filter string into the Filter: field, select a direction, and click on OK. [. . . ] Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. [. . . ]