Additionally, Wireshark provides us a larger variety of filters for advanced analyses like creating macros in display filters and adding predefined expressions to the display filter, specifying vendors, IEEE standard devices, and so on. It supports all interfaces, ports and protocols. It helps us to filter out packets and shows us the traffic as per the query. The display filter is like a search engine in the PCAP file. Proto (Protocol): Proto specifies the possible protocol combinations, whether its TCP or UPD, along with the port number.

Dir (Direction): Dir is used to specify the inward or outward direction.

Type: Used to select the type of traffic like Host, Network, protocol, and Port range.

We use Capture Filters to filter, in a predefined manner, and to view only particular criteria of traffic. Let’s see how analysts can leverage them to narrow down the capture packet noise and clear it. We know that there are two filters: capture Filters and display filters.

In this article, we will discuss other methods to extract information from packet captures. In part 1, we explored some of Wireshark’s options for security analysis and information extraction from network traffic captures.

Wireshark capture https traffic