【背景】
参考自己之前的:
【记录】折腾WireShark(旧称Ethereal)
去在K470中的当前Win7 x64中又安装了Wireshark。
然后去尝试抓包分析数据。
然后运行一个网络相关的程序,抓取出来一堆数据:
现在希望,能否配置一下,只显示出对应的代理地址是173.0.50.50的哪些项。
【解决过程】
1.折腾半天,参考了:
wireshark过滤语法总结
Wireshark 过滤器
以及Wireshark自带的帮助文件中的:
6.6. Defining and saving filtersYou can define filters with Wireshark and give them labels for later use. This can save time in remembering and retyping some of the more complex filters you use. To define a new filter or edit an existing one, select the Capture Filters… menu item from the Capture menu or the Display Filters… menu item from the Analyze menu. Wireshark will then pop up the Filters dialog as shown in Figure 6.8, “The "Capture Filters" and "Display Filters" dialog boxes”. Note! The mechanisms for defining and saving capture filters and display filters are almost identical. So both will be described here, differences between these two will be marked as such. Warning! You must use Save to save your filters permanently. Ok or Apply will not save the filters, so they will be lost when you close Wireshark.
Figure 6.8. The "Capture Filters" and "Display Filters" dialog boxes
- New
This button adds a new filter to the list of filters. The currently entered values from Filter name and Filter string will be used. If any of these fields are empty, it will be set to "new". - Delete
This button deletes the selected filter. It will be greyed out, if no filter is selected. - Filter
You can select a filter from this list (which will fill in the filter name and filter string in the fields down at the bottom of the dialog box). - Filter name:
You can change the name of the currently selected filter here. Note! The filter name will only be used in this dialog to identify the filter for your convenience, it will not be used elsewhere. You can add multiple filters with the same name, but this is not very useful. - Filter string:
You can change the filter string of the currently selected filter here. Display Filter only: the string will be syntax checked while you are typing. - Add Expression…
Display Filter only: This button brings up the Add Expression dialog box which assists in building filter strings. You can find more information about the Add Expression dialog in Section 6.5, “The "Filter Expression" dialog box” - OK
Display Filter only: This button applies the selected filter to the current display and closes the dialog. - Apply
Display Filter only: This button applies the selected filter to the current display, and keeps the dialog open. - Save
Save the current settings in this dialog. The file location and format is explained in Appendix A, Files and Folders. - Close
Close this dialog. This will discard unsaved settings.
|
和:
6.5. The "Filter Expression" dialog boxWhen you are accustomed to Wireshark’s filtering system and know what labels you wish to use in your filters it can be very quick to simply type a filter string. However if you are new to Wireshark or are working with a slightly unfamiliar protocol it can be very confusing to try to figure out what to type. The Filter Expression dialog box helps with this. Tip! The "Filter Expression" dialog box is an excellent way to learn how to write Wireshark display filter strings.
Figure 6.7. The "Filter Expression" dialog box
When you first bring up the Filter Expression dialog box you are shown a tree list of field names, organized by protocol, and a box for selecting a relation. - Field Name
Select a protocol field from the protocol field tree. Every protocol with filterable fields is listed at the top level. (You can search for a particular protocol entry by entering the first few letters of the protocol name). By clicking on the "+" next to a protocol name you can get a list of the field names available for filtering for that protocol. - Relation
Select a relation from the list of available relation. The is present is a unary relation which is true if the selected field is present in a packet. All other listed relations are binary relations which require additional data (e.g. a Value to match) to complete.
When you select a field from the field name list and select a binary relation (such as the equality relation ==) you will be given the opportunity to enter a value, and possibly some range information. - Value
You may enter an appropriate value in the Value text box. The Value will also indicate the type of value for the field name you have selected (like character string). - Predefined values
Some of the protocol fields have predefined values available, much like enum’s in C. If the selected protocol field has such values defined, you can choose one of them here. - Range
XXX – add an explanation here! - OK
When you have built a satisfactory expression click OK and a filter string will be built for you. - Cancel
You can leave the Add Expression… dialog box without any effect by clicking the Cancel button.
|
后,自己去试试:
新建一个filter:
设置:
设置目标地址为上述的代理地址:
默认会有new,去掉new,保留表达式:
如此,即可实现,只显示目标地址为上述代理地址的项了:
【总结】
wireshark,真是很强大,好用。赞一个。
转载请注明:在路上 » 【已解决】Wireshark中配置过滤器Filter使得只显示某个目标地址的项
Post Views: 1,847