In this lecture, we are going to take a look at the two special operators contains and matches.
So let's start with the contains operator contains allows us to search our filter packets based on a
word or phrase that you supply to it.
Let's say you want to display all the packets that contain the word log in right now here we can use
the contains operator.
So type TCP contains and type the word that you want to search.
I'm going to type log in.
Now, this filter is going to display all the TCP packets that contain the word log in.
So if I press enter now, Wireshark has listed all the packets that contain the word in.
As you can see in the first packet, we have a word.
Log in right here, log into our PCB.
But in the second packet user info dot PHP, it doesn't seem to contain the word log in, but the word
log in is present somewhere in the this packet.
So let me expand the hypertext transfer protocol and the word login should be somewhere here.
As you can see down here, we have the word log in dot p b.
So why is all the packets that Wireshark has listed here?
They contain the word log in somewhere.
We can use UDP as well.
So replace TCP with UDP.
And this time I'm going to search for, let's say NY City Press enter.
Now Wireshark is displaying the UDP packets that contain the word and wide and contains operator can
be used with many other protocols as well.
For example, let's say search.
Now as you can see, it is a valid filter in the same way you can use with FTP or DNS, DHCP and ARP
ADC.
Right.
The matches operator is similar to contains.
It works very much like the way contains works.
So here if I replace the contains operator with matches.
Now if I press enter as you can see guys, it has produced the similar result as the contains.
Right now the matches operator offers some additional features which are absent in the contains operator
matches.
Operator was developed to overcome the limitations of contains.
The main limitation of contains operator is that you can only search for one word or phrase at a time.
You can't search for multiple phrases with a single contains operator, whereas matches operator allows
us to search for multiple phrases at once.
You can give a group of phrases to it, then it will search those for you.
Let's say I want to display all the packets that contain the word login or success.
Then here we can use matches.
Operator So within the double quotes and parenthesis, write the phrases that you want to search for.
Let's say log in now.
Separate your phrases with the piper.
Press enter.
Now, Wireshark has listed all the packets that contain either login or successor.
So here, as you can see, all these packets contain either login or success in them.
Let me scroll down.
As you can see, guys, here we have the word success, right?
So with matches, operator, you can search for as many phrases as you like.
Just separate your phrases with a pipe.
And just like containers, you can use matches with other protocols as well.
For example, UDP, let me replace log in with an ID and search or HTTP TLS ADC.
Right.
Another feature that it offers is a you can use Perl based regular expressions with matches.
Operator.
We will cover regular expressions in another lecture.
Thank you, guys.
I'll see you in the next video.