How to Filter Traffic // Intro to Wireshark Tutorial // Lesson 5

Let's keep learning more about Wireshark in this tutorial. Filtering traffic with Wireshark is important for quickly isolating specific packets and dig down to the ones that matter. They are very important to learn for troubleshooting and traffic forensics.
The problem is that filters can be hard to learn and remember, especially when you are first getting started with Wireshark. In this video we will look at capture vs display filters, how they work, and some common filters we can use to isolate traffic.
Please smash the like button to let me know if you dig this content!
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...
Chapters in video:
0:00 Introduction to FIltering
0:29 Capture vs Display Filters
2:00 Creating Capture Filters
4:18 Display Filter Syntax
7:00 Right-Click Filtering
9:02 Tips for creating filters
10:08 Filtering for a text string

[@steelcoyote2868]

@9:30 you have to add commas inbwtween the ports now in v 4.05. tcp.port in {80, 443, 8080}

[@brianachenbaugh1470]

TY!!!!

[@Flowerofkindness]

I appreciate you

[@jasenhicks]

Thank you!

[@user-ss2cs6gc8g]

Version 4.0.4 Filtering for a text string works ony if you put Google into quotes: frame matches "google"

[@ChrisGreer]

I know, love how that was changed in 4.0! Used to be that either way worked but now it's only the quotes.

[@marwit2928]

Thank you!!!!

[@Flowerofkindness]

Thanks bud

[@alandoran]

Hey Chris, great video again. Learning lots. Thanks for taking the time to publish these.

[@tylerbelgrade]

the best wireshark series ever. Thanx Chris.

[@jayydon]

You genuinely answered the question which originally sent me hunting for tutorials, fantastic. Cheers Chris, Love from the Countryside,

[@breakingthespell6083]

Great Master Class on Wireshark.

[@TheChinobi23]

So glad i found you, i have upped my skills in wireshark thabks to you! Thanks

[@ingriedsiegbert9799]

Great Chris! And really pleasant!

[@venkatesh4760]

Thanks Chris For your informative video..I am watching all your videos in all the platforms youtube,Pluralsight.. Learnt a lot from ur videos.

[@ChrisGreer]

Thanks! I appreciate the feedback.

[@louisvarre2197]

Awesome as usual!

[@ahmedcmc]

Thanks , Great video

[@rgh2918]

Thanks for your nice explanations.

[@TheKhirocks]

Great series so far. Hoping you will go as far as looking at protocols in wireshark such as smb, nfs, dns, ldap. Looking at the various values, what they mean and troubleshooting some common issues such as poor copy performance, ntlm/Kerberos authentication issues etc. Not asking for too much eh 😉. I ask because i KNOW you are capable of explaining it well!

[@ChrisGreer]

Hey thank you for the comment - this series will focus more on the analyzer itself than the protocols. But, I will keep making content around different troubleshooting scenarios!

[@artbyhedyeh]

Thanks for your videos.

[@vyasG]

Thank you for this video. Learning a lot from your videos.

[@ChrisGreer]

Glad to hear it!

[@robl39]

As a developer, I’d love to learn Wireshark mostly for capturing HTTP/HTTPS between my development machine and various APIs. I ended up just using Fiddler because Wireshark seemed much harder to figure out. The bar to entry seemed too high for something simple. Your videos might help me finally commit to learning Wireshark though!

[@geekbored]

Thanks Chris. In Windows you need to use - frame contains "google" or frame matches "google". My Version - Version 4.0.0 (v4.0.0-0-g0cbe09cd796b).

[@Qwarkeh]

Same on linux for Version 4.0.2, might just be a newer version thing

[@trapmosqtrapmosq1059]

One of the best trainer !!!!

[@ChrisGreer]

Thanks!

[@krunallakhani3420]

amazing.. nice info

[@wagnerj01]

Thanks for the video. I am learning alot.

[@ChrisGreer]

Thank you!

[@brahmadude8955]

Great content.. 🙏🙏🙏🙏🙏 Master

[@himanshusharma7860]

Hey chris thanks for uploading videos will the future videos in the series also include some T-shoot TIPS?

[@maxwellchessdotcom6952]

Great channel!

[@ChrisGreer]

Thanks!

[@bhumithit]

Great video Chris, please make a video series on TCP/IP fundamentals.

[@ChrisGreer]

Got you covered - kzbin.info/www/bejne/rpW0aqadpdCljpo

[@bhumithit]

@@ChrisGreer Thanks Chris. Learning a lot from your vids. Really appreciated. 👍👍👍

[@agritech802]

Thanks for a great video. How can you see the source application of the request and the content of the packet?

[@jeffm2787]

Great stuff.

[@ChrisGreer]

Glad you enjoyed it

[@chinmayrath8494]

Absolutely loving the series and especially how you show the bigger picture apart from things just inside wireshark. thanks!!

[@manigandansrinivasan5194]

Great video

[@ChrisGreer]

Thanks!

[@gunjanskitchen7014]

Super

[@ashishsolanki86]

Hi Chris, Can you please help in understanding different flags that we see in capture like the one below: 10.236.28.5.63737 > 40.79.154.87.443: Flags [.] --> What this . [dot] signifies inside brackets. Also, if you share some light on how to check DNS related issues via capture.

[@quarkdaniel3354]

nice job

[@ChrisGreer]

Thanks for the comment Daniel!

[@govindaraoregada750]

In wireshark 4 version, I do not see "frame contains or frame matches" string filters.

[@washyourhands907]

Hey Chris, this series is amazing. However, some of these commands are out of date. I just tried them in wireshark and they didn't work for me. Ex. "frame contains/matches google" didn't work and searching by port number. The santax changed a bit for searching by port number, but I couldn't find out how to do the first one I talked about. Do you have any updated commands for these please?

[@KalendilTiger]

the syntax for contains requires quotation marks now, as in: frame contains "google"

[@fifthamendment1]

Is a pc using wireshark able to capture all traffic or just traffic specifically with that pc?

[@auslander1026]

10:00 using 4.0.2 on mac - text strings dont work for some reason: neither frame contains nor matches...

[@Ishvires]

Is it possible to have a filter for such scenario: imagine you are in a voice call and you have voice packets going in and out + you have some other packets because your other software installed using network and here is the thing: is it possible to build a filter which will ignore everything what is happening right now and will start showing packets if something new appears from next moment? In other words - ignore packets from every connection and just show packets from new connections? Obviously it is possible to build this filter manually, but this is quite labor intensive, but maybe you know a way/trick which could solve this with few mouse clicks?

[@joshsawyer9880]

when trying to setup a ring buffer and save the files into a folder it says "Ring buffer requested, but capture isn't being saved to a permanent file."

[@TV_Schleuderprogramm]

11:25 Wireshark has continued to evolve, frame contains google as in the given example doesn't word anymore, you have to put quotas as in frame contains "google".

[@susmitamazumder8390]

Hi Chris how frequently are you going to put videos here

[@ChrisGreer]

Hello Susmita, I've been planning on one per month for this series, but then QUIC happened. :-) I have more content in the pipeline for this one.

[@yamatoyukihiro]

Hi, how do I filter stun traffic?

[@romesan2011]

Is string 'contains' not supported in WIreshark 4.0.5 ?

[@ChrisGreer]

It is, but you have to wrap the string in quotes. frame contains “Facebook”

[@thisrapthebeast7572]

it seems like my antivirus is blocking my port scans...

[@user-rv6gl5oo4t]

Hello @Chris. I tried but tcp.port in {80 443 8080} shows incorrect syntax with "red" in the display filter field. However, tcp.port in {80, 443, 8080} is "green" and gives same filter result as tcp.port == 80 || tcp.port == 443 || tcp.port == 8080. Currently using Wireshark Version 4.2.0 (v4.2.0-0-g54eedfc63953) on WIndows 11.

[@ChrisGreer]

Hey thanks for the comment. You are correct, in pre-4.0, the filter would work without commas separating the values between the curly braces. Now from 4.0 and newer, we need the commas. Unfortunately I can't update it in this video, but my more recent content reflects this change.

[@philips.289]

Hi there if I type in "frame contains google" or "frame matches Google" it just get red and I can not apply the filter. Not sure for what reason this does not work 🤷.

[@philips.289]

Adding quotes fixed it: frame contains "google"

[@zsahe21]

!!!!

[@wagnerj01]

Weird, I had to use this format: frame contains "google" frame matches "google"

[@ChrisGreer]

No you are now correct in that syntax. Pre-version 4.0, you did not need the quotation marks. Now 4.0 requires them. Haven't gotten around to re-shooting this video yet!

[@dinohunter7176]

Hi, thanks for video, is there a command to group lines by same message so it show a message just once on multiple requests? Something like group by dns.qry.name

[@ChrisGreer]

I would probably do that with tshark. "tshark -r (filename) -T fields -e dns.qry.name | sort | uniq -c" That will extract all the qry names to a list and only show them once.

[@dinohunter7176]

@@ChrisGreer Thank you!