Check out this TCP Stream Filter!

[@802.11Guitar]

Brilliant, awesome tip, very useful!!! I will add it to my buttons, thanks for sharing!!!

[@ChrisGreer]

You're welcome! Glad it helps.

[@yamguerra9662]

Thank You for your profile, it was a great profile, I realized that you made folders and grouped the filters into groups. I checked that and that order seemed great to me.

[@DevrishiPathak-n1o]

Great show as always, very helpful. Thanks again.

[@Vinfinite-l3c]

Amazing, thanks for the profile and the lesson.

[@PST_1414]

As always.... Great way to explain in a short video.. like the way you teach.. Thanks for creating these awesome videos for us.. Respect..

[@josea.hernandezs.348]

OMG! your video was a "blow my mind" moment about use the field value as variable, that definitely will help me a lot. thanks, master!

[@ChrisGreer]

@@josea.hernandezs.348 oh yeah! That thing is a game changer. I have a few others that really help - like click a DNS reply and use “ip.addr==${dns.a}” no quotes. Pulls the IP address out of the dns reply and sets it as an ip address filter. 😉

[@josea.hernandezs.348]

🔥

[@josea.hernandezs.348]

@@ChrisGreer​ let me show you my first new level filter, i normally work with voip, this filter allow me tracking and specific call with his associate audio stream just clicking on the INVITE method "sip.Call-ID==${sip.Call-ID} or udp.port==${sdp.media.port}" and combo x2 with your DNS filter, this is other level!🔥

[@AndyRome]

Thank you Chris, I love following along with you. You are the GOAT brother!

[@ChrisGreer]

Thanks for the comment!

[@xDx4444]

Thanks a lot, Chris :)

[@freddrune8315]

Great video sir. I find that trick to be very useful.

[@x0rZ15t]

That is pretty cool trick!

[@tranxn7971]

Thanks a lot for the tip and also for the profile file, that's very useful. I wish there was a way to go back to the previous filter. Like when you do "follow tcp stream", it is going to change the filter you had by "tcp.stream==xx" and it is a bit annoying to have to go through filter history to pull back your previous filter.

[@ChrisGreer]

So there is a dropdown arrow just to the right of the display filter bar. That should show you the last couple filters you have used and applied. We don’t have a “back button” just yet but….

[@AsuraSKIes]

That is pretty neat! Thank you for sharing

[@ChrisGreer]

Thanks for watching!

[@MrE-h7n]

Thank you so much sir for you beautiful clear content, New Sub!!!

[@ChrisGreer]

Welcome to the channel! Thanks for subscribing

[@cloudalien443]

Cleverness in simplicity.

[@QEDAGI]

I'm Cris Greer-man 🦇! Thanks for the extended outro-music. Didn't realize how much I'd enjoy that.

[@ChrisGreer]

haha oops sorry!

[@ChrisGreer]

Fixed. haha... thanks for the tip.

[@zoren001]

you're the goat sir

[@MoveTrueRecords_]

Im here!!!!!

[@joerockhead7246]

slick

[@asv5769]

Hi Chris, is it possible to make Delta column to show time in ms instead of sec? Like multiply with 1000 to convert sec to ms. I couldn‘t make it.

[@anythinggoes1206]

thanks for the info, for some reason my WS doesnt seem to recodnise the command tcp.stream==${tcp.stream}. I copy/past it to shark, but still its red

[@ChrisGreer]

I literally just copied your text into mine and it went green. Version?

[@dopy8418]

Good wireshark kung-fu. Man i’ve been searching for a while the video where you show us how to customize Displayed names of our devices. Like my-computer or Dns-server. I know it’s off topic but can you help me out ?

[@ChrisGreer]

For sure! Ok now you got me thinking about making another video about it. First - Preferences | Name Resolution. Make sure the "Resolve network (IP) address" box is checked. Personally, I like to only check "Use captured DNS packet data for name res" after that. Uncheck the others. Next - go back to packet view. Right click the actual IP address you want to name. "Edit Resolved Name" A toolbar will appear. Enter the name, and BAM! there ya have it. Fresh video coming soon...

[@dopy8418]

@@ChrisGreer Ok got it and it works, only downside is on Ubuntu if i close Wireshark and reopen it my entries are gone so have to redo. There must be a config file somewhere, but that was more then helpful thanks. The also works fine.

[@chatters]

Is there any way to change back the right click > conversation filter > tcp to show back the ip/ports pair instaed of the stream number on ver 4.4.1 ? the previous way are useful if you are tracking a conversation with multiple capture files as the stream number are different.

[@ChrisGreer]

Ooooh not that i am aware. It keys in on stream number now. Good question though, I will keep my eyes open for a way. If you go to Statistics | Conversations | TCP - then do a right click filter for A B it will give you the filter you are looking for, but you have to use that extra step of using Statistics. Really though - I would probably just build a filter for the client side TCP port. It is often unique (ish) and allows me to build a filter that I can span across different capture files. You could build a filter button that uses this filter (no quotes) "tcp.port == ${tcp.srcport}" That will let you quickly rip the client port out of a packet, just make sure to click on a packet in the right direction!