Can this packet be filtered?

CaptureFilter

asked 2025-12-25 06:46:53 +0000

updated 2025-12-26 09:02:57 +0000

I have a large file with more than 90% of packets coming from one IP. If I was to filter based on IP, I would have to save 90% of the large capture file I have which I'd like to avoid.

Is there any way to specify just one packet with the following details that I got from my IDS?

TIME:              11/06/2025-16:57:44.496934
PKT SRC:           wire/pcap
SRC IP:            redacted1
DST IP:            redacted2
PROTO:             17
SRC PORT:          41893
DST PORT:          45547
FLOW:              to_server: FALSE, to_client: TRUE
FLOW Start TS:     11/06/2025-16:34:02.883356
FLOW PKTS TODST:   28056
FLOW PKTS TOSRC:   43406
FLOW Total Bytes:  58085272
FLOW IPONLY SET:   TOSERVER: TRUE, TOCLIENT: TRUE
FLOW ACTION:       DROP: FALSE
FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: FALSE, APP_LAYER: FALSE
FLOW APP_LAYER:    DETECTED: TRUE, PROTO 34
PACKET LEN:        1494

Further clarification:

I run an IDS and packet capture software simultaneously. What I've posted above is an alert from my IDS about a suspicious packet that it flagged.
I have a packet capture file and I am using suricata as my IDS.
Usually given an IDS alert similar to the above it's quite simple to go to Wireshark and zoom down to the troublesome single packet. I often use an expression like:

frame.time == "2025-10-13 08:17:35.073949+0200"
The above filter didn't produce any results this time. Using the data from the above IDS summary I've created the follwing filter which has narrowed my search. Of all the packets captured I've narrowed it down to 6.6%.

(frame.time_epoch >= 1762448264) && (frame.cap_len == 1494) && (ip.src == redacted1) && (udp.srcport == 41893)

Question: Any ideas about how to zoom down even more?

edit retag flag offensive close merge delete

Comments

What exactly is it you're trying to do?

Do you already have a file, and you want to extract that particular packet?

Or do you want to capture traffic from a network interface and capture packet that are just like that packet?

I'm guessing it's the first of those - in which case that's not what a capture filter would be used for in WIreshark or TShark.

Guy Harris ( 2025-12-26 01:29:15 +0000 )edit

Are the packets being decoded as cflow? (Display Filter Reference: Cisco NetFlow/IPFIX)

Which IDS is generating the log entry? Is there a mapping back to the netflow fields the data came from?
You may be able to filter on the SRC PORT, DST PORT, FLOW Start TS and FLOW APP_LAYER if they can be mapped to specific Wireshark fields.