Ask Your Question
0

How to use a short filter to capture only traffic to or from specified IP addresses

asked 2022-10-19 05:50:21 +0000

kekkou gravatar image

updated 2022-10-19 07:28:49 +0000

I just only care about two IP addresses, 10.86.50.153 and 10.86.50.152, but exclude any other traffic.

How to shorten the following Wireshark Capture Filter expression?

port 445 and ((src net 10.86.50.153 and dst net 10.86.50.153) or (src net 10.86.50.152 and dst net 10.86.50.153) or (src net 10.86.50.153 and dst net 10.86.50.152))

If I used the following filter expression,

port 445 and (src net 10.86.50.0/24 and dst net 10.86.50.0/24)

It will also display frames with IPv4 address equal to 10.56.50.27.

It will show traffic to or from 10.86.2.37 for port 445 and net 10.86.50.0/24.

My environment with Wireshark on 10.86.50.153,

+--------------+              +--------------+             +--------------+
|    Client    |              |     Proxy    |             |    Server    |
| 10.86.50.153 |:50624 -> 445:| 10.86.50.153 |:53822 ->445:| 10.86.50.152 |
+--------------+              +--------------+             +--------------+

+------------+            +--------------+           +-------------+
|   Client   |            |     Proxy    |           |   Server    |
+------------+            +--------------+           +-------------+
10.86.50.153 :50624 -> 445: 10.86.50.153 :53822 ->445: 10.86.50.152


+--------------+ 5      +--------------+ 5      +--------------+
|    Client    | 0 -> 4 |     Proxy    | 3 -> 4 |    Server    |
|              |:6    4:|              |:8    4:|              |
| 10.86.50.153 | 2 <- 5 | 10.86.50.153 | 2 <- 5 | 10.86.50.152 |
+--------------+ 4      +--------------+ 2      +--------------+

     Client                        Proxy                         Server
+--------------+       REQ     +--------------+       REQ      +--------------+
|              |-----+ --> +---|              |-----+ -->  +---|              |
| 10.86.50.153 :50624|     |445: 10.86.50.153 :53822|      |445: 10.86.50.152 |
|              |-----+ <-- +---|              |-----+ <--  +---|              |
+--------------+       RSP     +--------------+       RSP      +--------------+

port 445 and 152<=ip[15:1] and ip[15:1] <=153 and 152<=ip[19:1] and ip[19:1] <=153

Some potentially possibly useful References:

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2022-10-19 14:06:53 +0000

SYN-bit gravatar image

At first I thought you meant to capture only traffic between 10.86.50.153 and 10.86.50.152. But your comment to the other answer invalidates that assumption :-)

Do I understand you correctly that you want to capture:

  • All traffic to/from the host with IP address 10.86.50.152 and also
  • All traffic to/from the host with IP address 10.86.50.153?

In that case you can use the filter (host 10.86.50.152 or host 10.86.50.153) and port 445

... or even shorter, as both addresses form a clean /31 'subnet': net 10.86.50.152/31 and port 445

If this does not work, could you please elaborate on which IP combinations you do want to capture and which IP combinations you don't want to capture?

edit flag offensive delete link more
0

answered 2022-10-19 06:09:02 +0000

7ACE gravatar image

host 10.86.50.153 and host 10.86.50.152

edit flag offensive delete link more

Comments

I tried port 445 and host 10.86.50.153 and host 10.86.50.152, but it could only capture traffic to or from IP addresses 10.86.50.153 and 10.86.50.152 ( i.e. exclude traffic to or from not 10.86.50.153 and 10.86.50.152). Unfortunately, it also exclude traffic to or from 10.86.50.153.

BTW, my environment looks like this:

Client (10.86.50.153) <-> Proxy (10.86.50.153) <-> Server (10.86.50.152)

kekkou gravatar imagekekkou ( 2022-10-19 06:46:58 +0000 )edit

ip[15:1]>=152 and ip[19:1]>=152

7ACE gravatar image7ACE ( 2022-10-19 08:17:27 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-10-19 05:50:21 +0000

Seen: 1,581 times

Last updated: Oct 19 '22