Wireshark - Filter ldap bindresponse with invalidCredentials

edit

That's great!

I would like to filter ldap.bindrequest_element containing the username and ldap.bindresponse_element containing the code 47 (invalidCredentials)? How can I do that?

Regards,

TM

Do you have an example capture you can share? Are you hunting specifically for the username of bind failures? That might be better handled with tshark in a script?

This is an example of the traffic

ldap.bindrequest:

698 2020-12-16 17:30:27.531252    0.000005       10.1.1.97          10.9.4.200           LDAP     255    255        68         138        138         70              31022      bindRequest(**8752915**) "CN=U101681,OU=Usuarios,DC=domain,DC=corp" simple

ldap.bindresponse:

760 2020-12-16 17:30:27.537191    0.000005       10.9.4.200           10.1.1.97          LDAP     298    127        138        138        251         113             65344      bindResponse(**8752915**) invalidCredentials (80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 775, v2580)

I would like to filter the ldap.bindrequest containing the username and the ldap.bindresponse containing the message "invalidCredentials" related to the bindrequest that was sent.

Best regards,

TM

That's going to take two passes - one to get the message ID of packets with invalidCredentials then a second to grab all packets with those message IDs.
1. If you want something in the Wireshark Gui, consider a Lua script.
2. On the command line, tshark could be used. Here is @SYN-bit covering that at Sharkfest: SF19US - 04 Solving (SharkFest) packet capture challenges with only tshark (Sake Blok)
3. A combination would be to create a display filter of the matching message IDs then copy/paste that into Wireshark:

$ cat LDAP_errs
#!/bin/bash

TSHARK="tshark.exe"
INFILE=$1

MESG_ID=`$TSHARK -r $INFILE -Y ldap.resultCode==49 -T fields -e ldap.messageID | tr -d '\r' | tr '\n' ' '`

echo "(ldap.messageID in {$MESG_ID})"

$ ./LDAP_errs filein.pcapng
(ldap.messageID in {8 14 20 })