Aus exmediawiki


$ ping target.com

list ip + macadresses in network

$ arp -a

for ping 256 last ip in your network

nmap -sP 
nmap -T4 -F

list ip-adresses

$ netstat -r

hostname / computername ?

$ nslookup
$ dig -x

mein computername
$ host `uname -n`



http.request.method == "POST"

Um zu ermitteln, ob ein User im Netz unverschlüsselte E-Mail-Kommunikation betreibt, reicht ein einfacher Capture-Filter:

tcp port 110 or tcp port 25 or tcp port 143

see also: http://www.thegeekstuff.com/2012/07/wireshark-filter/

displays all TCP resets


displays all HTTP GET requests


displays all TCP packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID

tcp contains traffic 

Sets a filter for any packet with, as either the source or dest

ip.addr == 

sets a conversation filter between the two defined IP addresses

ip.addr==  && ip.addr== 
Match destination: ip.dst == x.x.x.x
Match source: ip.src == x.x.x.x
Match either: ip.addr == x.x.x.x

$ ping target.com
$ arp -a

In the list returned by the arp command, search for the IP address you found with the ping command. Once you have the MAC address – say, "AA:BB:CC:DD:EE:FF" – type in the filter box:

eth.addr == AA:BB:CC:DD:EE:FF

Now suppose you want to capture all traffic using specific protocols generated by a host, such as pop3, ftp, http, or messenger. In the filter box, enter:

ip.addr == and (http or ftp or messenger or pop)

This says show all the traffic generated or directed to the IP address and display only http or ftp or pop or messenger packets.

You can capture all such traffic that runs over your network with a specific address or from multiple clients:

ip.addr == 192.168.0 and (http or ftp or messenger or pop)

ip.addr== --- Show all traffic from and to
tcp.port==80 --- Show all the traffic with 80 as a source or destination port
ip.src== and ip.dst== --- Show all the traffic that starts from and has as target
ftp --- Show only the traffic for the ftp protocol
http --- Show only the traffic for the http protocol
dns --- Show only the traffic for the dns protocol

Show all http traffic where the url contains the word "string."

http.request.uri contains string