top of page
  • Writer's pictureLaura Chappell

Free Lab: Wireshark Layered Display Filters

The ability to look for a field or a field value at a specific layer is one of the many cool display filter enhancements recently added to Wireshark. Have you had a chance to play with it yet?


Here's a free (and short) Wireshark lab that will give you a feel for the layered display filter feature.


Step 1: Grab the Trace File for This Free Lab

Download whatup.pcapng.

If you spend a moment looking through this trace file, you'll notice some suspicious activity right away - port scans, a TLS handshake failure, a MySQL error response, etc.


This is a trace file I use in classes to teach folks how to customize Wireshark to quickly detect all types of errors.


We will use this file to examine the layered display filter feature. Try not to get distracted by the concerning packets (or have fun detecting them).


Step 2: Filter on ip.dst

Apply a display filter for ip.dst == 192.168.1.5. This filter displays all packets that contain 192.168.1.5 in any IPv4 destination address (ip.dst) field. Your filter should display 4812 packets.


But what if you are working with traffic that contains protocols embedded within protocols? For example, ICMP Destination Unreachable packets echo back part of the packet that triggered the Destination Unreachable response (the IP header and 8 bytes of whatever followed it... although most stacks echo back more than just 8 bytes if they exist).

ICMP packet with 2 IP headers

Step 3: Apply a Layered Filter

To filter on the ip.dst address field contained in the second IP header of packets, you must use a layered display filter. You must tell Wireshark in what layer you are interested. In this case, we are interested in the second layer.


Apply a filter for ip.dst#2 == 192.168.1.5.


Only one frame (#2223) should match your filter. That is the only frame that contains 192.185.1.5 in the second ip.dst field.


frame with 192.168.1.5 in the second ip.dst field

You can also use a range in your layered filters. For example, if you have 4 layers of embedding of the same protocol, you can indicate that you are only interested in the first three layers of a field occurrence using the syntax fieldname#[1-3]==value.


Enjoy!


7 Comments


Swarna Yadav
Swarna Yadav
Jul 11

Feel the pleasure of sensuality at its peak when you are connected with high-profile top Call Girls Service in Andheri. It is a well-known fact that call girls are very popular in Andheri. Our girls are in huge demand as handsome hunks want to date them. Girls are very beautiful and love to meet handsome housefull stuff. They enjoy making boyfriends and have passion in intense love making sessions with them.

Like

su xeko
su xeko
Jul 03

I learned a lot from your blog, and you can learn more about older video games to have more engaging experiences. I look forward to playing with you in the past! word wipe

Like

Tannu Rawat
Tannu Rawat
Jun 29

Are you looking for an unforgettable experience in Mumbai? Look no further than the independent Mumbai Escort Service in this vibrant city. These stunning women offer more than just companionship; they provide a level of intimacy and sensuality that is truly unmatched.

Like

sapna mathur
sapna mathur
Jun 27

Mahipalpur Escorts shows the girls who work as Mahipalpur Escorts are listed here. This website is a classified website associated with many cities, and there are many Mahipalpur call girls profiles available so that you can contact them through WhatsApp or phone call as per your choice. We appreciate your sentiments and thank you for choosing Mahipalpur call girl to fulfill your wishes.

Like

sapna mathur
sapna mathur
Jun 21

Mostly we prefer to provide service in Lucknow female escorts in a faster hotel because there is no problem, and we can provide this service to the maximum number of people. So if you are looking for the best quality escort services in Lucknow If you want to take me, then we are ready to support you in every way, our cooperation is best for you, and we want to provide you with the best quality female escort service in Lucknow.

Lucknow Escorts || Lucknow Escorts Service || Escorts in Lucknow || Lucknow Escorts Agency || Lucknow Escort || Escort in Lucknow || Escorts Service in Lucknow || Lucknow Escort Service || Escort Service in Lucknow || Independent Lucknow Escorts…

Like
bottom of page