In this lecture, we are going to learn how to optimize the filtering techniques using logical operators
not and or.
Alright, so let's start with the or operator or operator allows us to combine multiple filters.
For example, let's say you want to see HTTP and ARP packets.
Just type or between the filters.
Now I am basically telling Wireshark that if you find the A.P. packets or ARB packets, then show me
all of them.
Right?
So this filter is going to display all the ARP and HTTP packets in the list.
So if I hit enter, as you can see, guys, now we only have at HTTP traffic and let me see the ARP
packets as well.
As you can see, we have the ARP traffic as well.
So guys, in this way you can combine as many filters as you like.
All you need to do is separate them with order.
Now this time let me go for ESI MP traffic hit enter.
Now we should have ICMP traffic as well as you can see.
So yeah, like I said, you can combine as many filters as you like with our operator.
Now next operator that we have is not OC before moving to north.
Let me show you another way of writing our operator instead of writing.
Or you can write these two symbols.
These are called pipes.
As you can see, it is a valid filter.
Now let's move to the node operator, not operator.
Basically, a negates the value that you supply to it.
For example, let me type not TCP now not operator is going to negate or ignore the TCP packets.
So this filter will not display the TCP packets.
I am basically telling Wireshark that do not display the TCP traffic.
So if I hit enter under the protocol column, you are not going to see any TCP IP packet as you can
see.
So not operator has basically excluded the TCP packets.
Right.
Now, let me give you another example.
Let's say UDP, not UDP.
Now, as you can see, UDP packets have been filtered out.
Now let's combine multiple filters.
Let's say you want to filter out UDP and TCP packets, right?
When you need to combine multiple filters, we have to use our operator.
So if I write something like this, not UDP or not TCP, as you can see syntactically it is a valid
filter, but it is not going to produce the result that you want.
So let me hit enter.
As you can see, we have both UDP and TCP traffic, right?
Because this filter does not make any sense.
What I'm telling Wireshark is that do not show me UDP packets or do not show me the TCP packets.
Right?
So when you want to negate multiple values, we have to supply the filters in the brackets.
So inside brackets, right.
Not TCP or UDP.
Now this time, what I am basically telling Wireshark is that if you find UDP or TCP packets, then
negate them.
Do not show me the packets that I have specified in the bracket.
Now, if I hit enter, as you can see, why is it has removed all the UDP or TCP packets?
Now let me add another filter.
Let's see ICMP.
Now, as you can see, it has removed all the specified traffic.
We are only left with the ARP packets.
Right.
Not operator can be returned with exclamation mark as well.
As you can see, it is also a valid filter.
If I hit enter it is producing the same result.
So exclamation and not both are same now.
Another of.
It is that we have is and we will cover the end operator in the next lecture with an appropriate example.