Wireshark semi-noob here. I have two devices that talk to each other over 802.11, and I need to reverse engineer the protocol (we are emulating one of the devices, and don't have full docs). The protocol is more or less ASCII strings over UDP over wireless, i. e. text strings, SQL queries, etc. I am able to sniff packets that I know are part of the dialog between client and server. I can search captured packets for known strings and see them; I can search for hex values of IP addresses and find them. I cannot (but would like to): - Filter by IP address - Filter by port number - Filter out data payload from header, etc. Does wireshark even have a way to make this easy? And (should be simple): How to log raw binary packet captures? Thanks lots Eric asked 22 Apr '13, 08:28  EricFowler edited 22 Apr '13, 18:09  Guy Harris ♦♦ |
2 Answers:
There are several ways. Some are easier than others.
I'm not sure if the generic dissector will solve all your problems/requirements, but it is for sure easy to start with.
What do you mean by that? Regards answered 22 Apr '13, 12:46  Kurt Knochner ♦ edited 22 Apr '13, 13:33 |
What do you mean by "filter"? "Filter by IP address" and "Filter by port number" sound as if they mean either "capture only packets to/from/both a particular IP address/port number" or "in a capture I have, show me only the packets to/from/both a particular IP address/port number". Both of those should be possible with Wireshark, e.g. a capture filter of You can also search for packets to or from a particular IP address or UDP port - "Find packet by display filter", in the "Find Packet" dialog, lets you search for packets that match an arbitrary display filter address, such as "Filter out data payload from header" is a completely different type of filtering; Wireshark shows complete packets, so there's no way to do that. What you can do, however, is, in the packet detail pane, not open up anything other than the bottommost tree item, which, for the packets you're interested in, will probably just be "Data", below "UDP", unless some other dissector happens to claim those packets. You could also, as Kurt suggests, write your own dissector for that protocol. answered 22 Apr '13, 19:17 Guy Harris ♦♦ |
