Wireshark is a packet sniffing and analysis tool. It captures network traffic on the local network and stores this data for offline analysis. Wireshark captures network traffic from various sources such as Ethernet, Bluetooth, wireless, etc.
Filter Toolbar Function
The Filter Toolbar in Wireshark provides several functions to help users quickly filter and search for specific network packets in a capture file. it’s mainly used for finding the specific network protocol, capturing the protocol, and filtering that protocol.
As you can see in the image of an overview of the Wireshark along with the filter toolbar function, there is a search bar where is written Apply a display filter.
So in the Filter toolbar function, there are some signs are present which are listed below.
Filter Toolbar
- Bookmarks – Manage or select saved filters.
- Filter Input – The area looks like a search bar is used to enter or edit a display filter string.
- Clear- The cross sign is reset to the current display filter and clear the edit area.
- Apply – The arrow sign is apply the current value in the edit area as the new display filter. Applying a display filter on large capture files might take quite a long time.
- Recent – Select from a list of recently applied filters.
- Add Button- The plus sign is like adding a button which is used for the new filter button.
Filter Toolbar Functions in Wireshark
The Filter Toolbar in Wireshark provides several functions to help users quickly filter and search for specific network packets in a capture file.
Some of the functionality is listed below.
- Capture Filters: This feature allows the user to apply filters to the capture before it starts. This is useful, for example, to limit captured traffic to specific protocols or IP address ranges.
- Display Filter: This function is used to filter the packets displayed in the main window of Wireshark. Users can apply filters based on various criteria such as source or destination IP address, protocol type, port number, etc.
- Clear Screen Filter: This function clears all currently applied display filters and displays all packets in the log.
- IP filtering: It allows you to control what IP traffic is allowed to enter and leave your network. Basically, it secures your network by filtering packets based on the rules you define.
- Search Packages: This feature allows users to search records for packages containing a specific string or value. Searches can be applied to specific fields in a packet, such as a packet payload or header fields.
- Go to Package: This feature allows users to quickly jump to a specific package in a survey based on the package number.
- Mark Packets: This feature allows users to mark packets in captured packets for further analysis or filtering. Users can manually or automatically tag packages based on specific criteria such as display filters or specific field values.
Overall, Wireshark’s filtering toolbar feature provides powerful tools to filter and search for network packets in captured files, helping users quickly identify and analyze specific traffic patterns and problems.
So let’s take some examples and understand how the Filter Toolbar Functions work in Wireshark.
Example 1: For example, we want to filter the source IP Address using the filter toolbar function in Wireshark. So we will put the IP Display filter in Wireshark. Suppose in our system many kinds of source IPs are coming and we want to filter any particular IP, then we use the following steps:
Source IP Address – Display filter for source IP Address.
ip.src == source ip address
Example 2: So in this example Now we will put the destination IP address and display filter.
Destination IP Address – Display filter for source IP Address.
ip.dst == destination ip address
For more details, you can refer to the Steps of Building Display Filter Expressions in Wireshark, and Display Filter Expression Dialog Box in Wireshark articles.