Ask Your Question
0

Is it possible to filter for a continuous range of ports?

asked 2021-01-29 20:31:13 +0000

jsrand1 gravatar image

Let's say I want to filter traffic on a range of ports like , e.g 21100 to 21299

Is it possible to specify a range in the filter?

Thc

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2021-01-29 21:19:46 +0000

cmaynard gravatar image

updated 2021-01-29 21:28:42 +0000

You didn't specify if you wanted a capture filter or Wireshark display filter, but it's possible either way, albeit with different syntax.

For the capture filter, you can use portrange 21100-21299, and you can refer to the pcap-filter man page for more information on capture filters.


For the display filter, you'd use something like tcp.port >= 21100 && tcp.port <= 21299, and keep in mind here that port in this context refers to either the source port or the destination port. Alternatively, and more succinctly, you could use the membership operator as in, tcp.port in {21100 .. 21299}.

NOTE: Replace tcp with udp if that's the transport applicable for your use case.

For more information on Wireshark display filters, refer to the wireshark-filter man page.

edit flag offensive delete link more

Comments

Thanks much!

jsrand1 gravatar imagejsrand1 ( 2021-01-29 23:35:20 +0000 )edit
0

answered 2021-01-29 21:11:28 +0000

Chuckc gravatar image

Display filter: tcp.port in {443 4430..4434} (Membership Operator in User's Guide)

Capture filter: portrange 1-1000 (See portrange in pcap-filter man page)

edit flag offensive delete link more

Comments

I guess I'm too slow typing and linking. Once again you posted your answer while I was still constructing mine. I wish Ask would warn me when this happens.

cmaynard gravatar imagecmaynard ( 2021-01-29 21:22:19 +0000 )edit

The more, good information the better. :-)

Chuckc gravatar imageChuckc ( 2021-01-29 21:26:55 +0000 )edit

Chuckc is a machine :-)

Jaap gravatar imageJaap ( 2021-01-30 19:15:55 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2021-01-29 20:31:13 +0000

Seen: 17,502 times

Last updated: Jan 29 '21