In this lecture, we are going to learn to write and apply the basic filters.
We will filter traffic using different protocols.
So let's get started.
This is the filter bar where you can type your filters.
So I'm going to start with the TCP protocol filter.
For TCP protocol is just TCP.
So type TCP, as you can notice, guys, as soon as you type the correct filter background color of
filter bar automatically changes to green.
If I type an invalid filter background color immediately changes to pink.
Now in order to apply filters, press enter or you can simply click on the button on your right side.
Right.
As you can see under the protocol column, Wireshark has filtered out or removed all other packets,
and it is only displaying the TCP packets or protocols that use TCP for delivering packets.
Let me scroll down.
As you can see, guys, here we have A.P. and deals traffic as well.
TLS is basically HTTPS or encrypted traffic at HTTPS and HTTP.
Both are application layer protocols and all the application layer protocols use either UDP or TCP for
delivering the packets.
Right now, let me find UDP traffic.
So type A UDP hit enter as you can see.
Under the protocol column, we only have UDP packets.
Right.
We also have some DNS packets as well.
Just like HTTPS or HTTP.
DNS is also an application layer protocol.
Okay.
DNS uses UDP for delivering packets.
Now let me find let's say ARPA packets.
So type R, as you can see, we do have to ARP packets now ICMP packets now it is just displaying the
ICMP traffic.
Right in this way, guys, you can filter not all but most of the network traffic using the protocols
a name.
You just need to remember the protocol name and type that in the filter bar.
Now, let me give you a few more examples.
I'm going to find the HTP traffic.
So type HTP hit enter.
As you can see, guys, under the protocol column, it is only displaying the HTTP traffic.
Now, how do you find the encrypted or HTTPS traffic?
Your first guess might be HTP s.
As you can see, it is not a valid filter.
Right.
So filter for filtering at https traffic is the L.
S transport layer security.
If I press enter now we only have the dls or https traffic.
Right.
HTP s uses TLS protocol to encrypt the traffic at https is basically a combination of http plus the
LS.
Right.
So TLS basically takes the http traffic then encrypts it.
So that makes the edge https.
Now moving on, let's say you want to check the search traffic then type ssh press enter.
I don't have any as I search traffic for now.
Now let me type FTP press enter again.
I don't have you know FTP traffic, but as you can see, it is a valid filter.
All right.
Let me try to remember a few more protocols DNS.
Now, as you can see, we have DNS queries and responses, right.
And the edge C P is also a valid filter.