Wireshark
Contents
Wireshark#
Wireshark User’s Guide#
DisplayFilters#
Building Display Filter Expressions#
Protocol field name#
tcp field name#
Common script#
// FIN / RST / SYN
tcp.flags.fin == 1 || tcp.flags.reset == 1 || tcp.flags.syn == 1
ip.addr==10.14.12.13 && tcp.flags.reset == 1 && tcp.port==8080
ip.addr==10.14.12.13 && tcp.port==8080
ip.addr==10.14.12.13 && tcp.port==8080 && tcp.flags.fin == 1
// TCP Keepalive
ip.addr==10.14.12.13 && tcp.port==8080 && tcp.analysis.keep_alive
// TCP Port number reused
ip.addr==10.14.12.13 && tcp.port==8080 && tcp.analysis.reused_ports
tcp.connection.rst
tcp.connection.fin_active
tcp.connection.fin_passive
// 主动 FIN
tcp.connection.fin_active || tcp.flags.reset == 1
// by packet index
tcp.stream eq 1006