Wireshark filtering for ip-port pair(Display filter)
I'd like to know how to make a display filter for ip-port in wireshark.
So, for example I want to filter ip-port 10.0.0.1:80, so it will find all the communication to and from 10.0.0.1:80, but not communication from 10.0.0.1:235 to some ip on port 80.
Answer
I want to filter out ip-port pair for any protocol that suports ports. Either tcp or udp. That ip-por pair can contact any other ip on any port.
(ip.src == XXX.XXX.XXX.XXX && (tcp.srcport == YYY || udp.srcport == YYY)) || (ip.dst == XXX.XXX.XXX.XXX && (tcp.dstport == YYY || udp.dstport == YYY) will match:
- all packets coming from IPv4 address XXX.XXX.XXX.XXX and TCP or UDP port YYY;
- all packets going to IPv4 address XXX.XXX.XXX.XXX and TCP or UDP port YYY;
which sounds as if it's what you want. (If it's not what you want, you'll have to be even more specific and precise about what you want.)