Wireshark 使用手册与过滤器完全指南¶

+------------------------------------------+
|  菜单栏 | 工具栏 | Display Filter 输入框   |
+------------------------------------------+
|  Packet List（数据包列表）                 |
+------------------------------------------+
|  Packet Details（数据包详细信息）          |
+------------------------------------------+
|  Packet Bytes（数据包字节流）             |
+------------------------------------------+

==  (eq)    等于
!=  (ne)    不等于
>   (gt)    大于
<   (lt)    小于
>=  (ge)    大于等于
<=  (le)    小于等于

and  (&&)   逻辑与
or   (||)   逻辑或
not  (!)    逻辑非
xor  (^^)   逻辑异或

contains    包含
matches     正则表达式匹配
in          在范围内

# 显示特定协议
http
tcp
udp
dns
icmp
arp
tls
ssh
ftp
smtp

# 排除特定协议
!http
not tcp

# 源 IP 地址
ip.src == 192.168.1.1
ip.src == 10.0.0.0/8

# 目标 IP 地址
ip.dst == 192.168.1.100

# 源或目标 IP
ip.addr == 192.168.1.1

# IP 地址段
ip.addr == 192.168.1.0/24

# 多个 IP 地址
ip.addr == 192.168.1.1 or ip.addr == 192.168.1.2

# 排除 IP
!(ip.addr == 192.168.1.1)

# TCP 端口
tcp.port == 80
tcp.srcport == 443
tcp.dstport == 8080

# UDP 端口
udp.port == 53
udp.srcport == 67

# 端口范围
tcp.port >= 1000 and tcp.port <= 2000

# 多个端口
tcp.port == 80 or tcp.port == 443 or tcp.port == 8080

# 源 MAC 地址
eth.src == 00:11:22:33:44:55

# 目标 MAC 地址
eth.dst == AA:BB:CC:DD:EE:FF

# 任意 MAC 地址
eth.addr == 00:11:22:33:44:55

# GET 请求
http.request.method == "GET"

# POST 请求
http.request.method == "POST"

# 其他方法
http.request.method == "PUT"
http.request.method == "DELETE"
http.request.method == "HEAD"
http.request.method == "OPTIONS"

# 所有响应
http.response

# 特定状态码
http.response.code == 200
http.response.code == 404
http.response.code == 500

# 状态码范围
http.response.code >= 400
http.response.code >= 400 and http.response.code < 500  # 4xx 错误
http.response.code >= 500  # 5xx 错误

# 主机名
http.host == "www.example.com"
http.host contains "google"

# 完整 URI
http.request.uri == "/api/v1/users"
http.request.uri contains "/admin"
http.request.uri matches "\\.(php|asp|jsp)$"

# 请求的完整 URL
http.request.full_uri contains "password"

# User-Agent
http.user_agent contains "Mozilla"
http.user_agent contains "curl"
http.user_agent contains "python"

# Cookie
http.cookie contains "session"
http.cookie contains "PHPSESSID"

# Referer
http.referer contains "google.com"

# Authorization
http.authorization

# Content-Type
http.content_type contains "application/json"
http.content_type == "text/html"

# 请求/响应包含特定字符串
http contains "password"
http contains "admin"
http contains "flag{"

# 请求体包含
http.request.body contains "username"

# 响应体包含
http.response.body contains "error"

# SYN 包（连接建立）
tcp.flags.syn == 1

# SYN-ACK 包
tcp.flags.syn == 1 and tcp.flags.ack == 1

# ACK 包
tcp.flags.ack == 1

# FIN 包（连接终止）
tcp.flags.fin == 1

# RST 包（连接重置）
tcp.flags.reset == 1

# PSH 包（立即推送数据）
tcp.flags.push == 1

# URG 包（紧急数据）
tcp.flags.urg == 1

# 只有 SYN 标志（三次握手第一步）
tcp.flags == 0x002

# TCP 三次握手
tcp.flags.syn == 1 and tcp.flags.ack == 0  # 第一步
tcp.flags.syn == 1 and tcp.flags.ack == 1  # 第二步
tcp.flags.syn == 0 and tcp.flags.ack == 1  # 第三步

# TCP 重传
tcp.analysis.retransmission

# TCP 乱序
tcp.analysis.out_of_order

# TCP 快速重传
tcp.analysis.fast_retransmission

# TCP 重复 ACK
tcp.analysis.duplicate_ack

# TCP 窗口满
tcp.analysis.window_full

# TCP 零窗口
tcp.analysis.zero_window

# 追踪特定 TCP 流
tcp.stream eq 0
tcp.stream eq 5

# 结合其他条件
tcp.stream eq 10 and http

# 序列号
tcp.seq == 1000

# 确认号
tcp.ack == 2000

# 窗口大小
tcp.window_size > 0
tcp.window_size == 0  # 零窗口

# DNS 查询
dns.flags.response == 0

# DNS 响应
dns.flags.response == 1

# 查询特定域名
dns.qry.name == "www.example.com"
dns.qry.name contains "google"

# DNS 查询类型
dns.qry.type == 1   # A 记录
dns.qry.type == 28  # AAAA 记录
dns.qry.type == 5   # CNAME
dns.qry.type == 15  # MX 记录
dns.qry.type == 16  # TXT 记录

# DNS 响应码
dns.flags.rcode == 0   # 无错误
dns.flags.rcode == 3   # NXDOMAIN（域名不存在）

# TLS 握手
ssl.handshake.type == 1  # Client Hello
ssl.handshake.type == 2  # Server Hello

# TLS 版本
ssl.handshake.version == 0x0303  # TLS 1.2
ssl.handshake.version == 0x0304  # TLS 1.3

# 服务器名称指示（SNI）
tls.handshake.extensions_server_name contains "example.com"

# TLS 应用数据
ssl.app_data

# TLS 证书
ssl.handshake.certificate

# FTP 命令
ftp.request.command == "USER"
ftp.request.command == "PASS"
ftp.request.command == "LIST"
ftp.request.command == "RETR"
ftp.request.command == "STOR"

# FTP 响应
ftp.response.code == 230  # 登录成功
ftp.response.code == 530  # 登录失败

# FTP 数据传输
ftp-data

# ICMP 类型
icmp.type == 8   # Echo Request (ping)
icmp.type == 0   # Echo Reply
icmp.type == 3   # Destination Unreachable
icmp.type == 11  # Time Exceeded

# Ping 请求和响应
icmp.type == 8 or icmp.type == 0

# ARP 请求
arp.opcode == 1

# ARP 响应
arp.opcode == 2

# 查找特定 IP 的 ARP
arp.src.proto_ipv4 == 192.168.1.1
arp.dst.proto_ipv4 == 192.168.1.1

# 按长度过滤
frame.len > 1000
frame.len < 100
frame.len >= 64 and frame.len <= 128

# IP 层长度
ip.len > 500

# TCP 载荷长度
tcp.len > 0  # 有数据的 TCP 包
tcp.len == 0  # 无数据的 TCP 包（如握手包）

# 时间间隔
frame.time_delta > 1  # 与上一个包间隔超过 1 秒

# 相对时间
frame.time_relative > 10  # 相对于第一个包超过 10 秒

# 包含特定字符串（任何层）
frame contains "password"
frame contains "flag{"
frame contains "admin"

# 特定协议包含字符串
http contains "login"
tcp contains "secret"
udp contains "key"

# 大小写不敏感（使用 matches）
http.request.uri matches "(?i)admin"

# 正则表达式
http.host matches ".*\\.example\\.com"
http.request.uri matches "/api/v[0-9]+/"

# HTTP POST 请求到特定主机
http.request.method == "POST" and http.host == "api.example.com"

# 来自特定 IP 的 HTTP 流量
http and ip.src == 192.168.1.100

# 非标准端口的 HTTP
http and tcp.port != 80 and tcp.port != 443

# 大数据包
ip.len > 1000 and tcp

# 可疑的 DNS 查询
dns and frame contains "exe"

# 失败的 HTTP 请求
http.response.code >= 400

# TLS 握手失败
ssl.alert_message

# 扫描行为检测
tcp.flags.syn == 1 and tcp.flags.ack == 0 and tcp.window_size <= 1024

# SQL 注入尝试
http.request.uri contains "select" or http.request.uri contains "union"

# XSS 尝试
http contains "<script>" or http contains "javascript:"

# 敏感信息泄露
http contains "password" or http contains "token" or http contains "api_key"

[协议] [方向] [类型] [值]

# 特定主机
host 192.168.1.1

# 源主机
src host 192.168.1.1

# 目标主机
dst host 192.168.1.1

# 排除主机
not host 192.168.1.1

# 整个网段
net 192.168.1.0/24
net 192.168.0.0 mask 255.255.0.0

# 源网络
src net 10.0.0.0/8

# 目标网络
dst net 172.16.0.0/16

# 特定端口
port 80
port 443

# 源端口
src port 12345

# 目标端口
dst port 22

# 端口范围
portrange 1000-2000

# 多个端口
port 80 or port 443 or port 8080

# TCP
tcp

# UDP
udp

# ICMP
icmp

# ARP
arp

# 组合协议和端口
tcp port 80
udp port 53

# AND
host 192.168.1.1 and port 80

# OR
host 192.168.1.1 or host 192.168.1.2

# NOT
not port 22

# 复杂组合
(host 192.168.1.1 or host 192.168.1.2) and (port 80 or port 443)

# 排除特定流量
not broadcast and not multicast and not arp

# 特定 MAC
ether host 00:11:22:33:44:55

# 源 MAC
ether src 00:11:22:33:44:55

# 目标 MAC
ether dst AA:BB:CC:DD:EE:FF

# 广播
ether broadcast

# 多播
ether multicast

# 只捕获 TCP SYN 包
tcp[tcpflags] & tcp-syn != 0

# 只捕获 TCP SYN-ACK 包
tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)

# 只捕获 TCP RST 包
tcp[tcpflags] & tcp-rst != 0

# HTTP GET 请求（简化）
tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420

# DNS 查询
udp port 53

# 大于 1000 字节的包
greater 1000

# 小于 100 字节的包
less 100

# VLAN 流量
vlan
vlan 100

# HTTP/HTTPS
http or tls

# WebSocket
websocket

# HTTP/2
http2

# SMTP（发送邮件）
smtp

# POP3（接收邮件）
pop

# IMAP（接收邮件）
imap

# FTP
ftp or ftp-data

# SFTP（SSH 文件传输）
ssh

# SMB/CIFS（Windows 文件共享）
smb or smb2

# SSH
ssh

# Telnet
telnet

# RDP（远程桌面）
rdp

# VNC
vnc

# MySQL
mysql

# PostgreSQL
pgsql

# MSSQL
tds

# MongoDB
mongo

# Kerberos
kerberos

# LDAP
ldap

# RADIUS
radius

# IPSec
esp or ah or isakmp

# OpenVPN
openvpn

# PPTP
pptp

# 导出 HTTP 对象
文件 → 导出对象 → HTTP

# 提取文件
frame contains "flag{" or frame contains "FLAG{"

# Base64 编码数据
frame matches "[A-Za-z0-9+/]{20,}={0,2}"

# 查找图片
http.content_type contains "image"
frame contains "PNG" or frame contains "JFIF" or frame contains "GIF89"

# HTTP 认证
http.authorization

# FTP 登录
ftp.request.command == "USER" or ftp.request.command == "PASS"

# Telnet 明文密码
telnet contains "password"

# HTTP POST 登录
http.request.method == "POST" and (http contains "password" or http contains "username")

# 可疑 User-Agent
http.user_agent contains "sqlmap" or http.user_agent contains "nmap"

# SQL 注入尝试
http.request.uri contains "union select" or http.request.uri contains "' or 1=1"

# XSS 尝试
http.request.uri contains "<script>" or http.request.uri contains "alert("

# 命令注入
http contains "| cat " or http contains "; ls " or http contains "& dir "

# 文件包含漏洞
http.request.uri contains "../" or http.request.uri contains "..%2f"

# Webshell 特征
http contains "eval(" or http contains "base64_decode" or http contains "system("

# SYN 扫描
tcp.flags.syn == 1 and tcp.flags.ack == 0

# 同一源 IP 的多个 SYN
tcp.flags.syn == 1 and tcp.flags.ack == 0
# 然后按 Statistics → Conversations

# 大量数据传输
frame.len > 10000

# DNS 隧道
dns and frame.len > 512

# ICMP 隧道
icmp and frame.len > 100

右键数据包 → Follow → TCP Stream / UDP Stream / HTTP Stream / TLS Stream

# 协议层次统计
Statistics → Protocol Hierarchy

# 对话统计
Statistics → Conversations

# 端点统计
Statistics → Endpoints

# HTTP 请求统计
Statistics → HTTP → Requests

# IO 图表
Statistics → IO Graph

Analyze → Expert Information

# 导出特定数据包
File → Export Specified Packets

# 导出对象（HTTP）
File → Export Objects → HTTP

# 导出为 CSV
File → Export Packet Dissections → As CSV

View → Coloring Rules

Analyze → Display Filter Macros

http.request.method == "POST" and http.request.uri contains "login"

frame contains "flag{" or frame contains "FLAG{" or frame contains "CTF{"

arp.duplicate-address-detected or arp.duplicate-address-frame

dns.flags.rcode != 0  # 非正常响应
dns.qry.name matches ".*\\.[a-z]{10,}$"  # 异常长的域名

http.content_type contains "application/octet-stream"

# ICMP 负载异常
icmp and frame.len > 100

# DNS TXT 记录
dns.txt

# HTTP 响应中的 base64
http.response and frame matches "[A-Za-z0-9+/]{50,}={0,2}"

# 捕获并显示
tshark -i eth0

# 捕获到文件
tshark -i eth0 -w output.pcap

# 读取文件
tshark -r input.pcap

# 应用显示过滤器
tshark -r input.pcap -Y "http"

# 捕获过滤器
tshark -i eth0 -f "port 80"

# 提取特定字段
tshark -r input.pcap -Y "http" -T fields -e http.host -e http.request.uri

# 统计
tshark -r input.pcap -q -z http,tree

# 分割文件（按数量）
editcap -c 1000 input.pcap output.pcap

# 分割文件（按时间，秒）
editcap -i 60 input.pcap output.pcap

# 提取特定时间范围
editcap -A "2024-01-01 00:00:00" -B "2024-01-02 00:00:00" input.pcap output.pcap

mergecap -w output.pcap file1.pcap file2.pcap file3.pcap

# 直接搜索 Flag 格式
frame contains "flag{" or frame contains "CTF{" or frame contains "FLAG{"

# 正则搜索
frame matches "flag\\{[a-zA-Z0-9_]+\\}"

# 搜索 base64 可能的 Flag
frame matches "[A-Za-z0-9+/]{20,}={0,2}"

# 查找图片文件
http.content_type contains "image" or frame contains "\x89PNG" or frame contains "JFIF"

# 查找压缩文件
frame contains "PK\x03\x04"  # ZIP
frame contains "Rar!"        # RAR

# 查找可执行文件
frame contains "MZ"  # Windows PE

# ICMP 数据隐写
icmp and frame.len > 100

# 异常 DNS
dns.qry.name.len > 50

# 异常 HTTP 头
http.request.line.len > 1000

# 非标准端口
http and !(tcp.port == 80 or tcp.port == 443 or tcp.port == 8080)

设置方法：
Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename

显示过滤器工具栏右侧 → + 按钮 → 保存
或：Analyze → Display Filter Expression → Favorites