In this lecture, we are going to learn how to capture application layer traffic like HTTP, https,
FTP or DNS adc.
Right?
Let's say you only want to capture the edge http traffic.
So if you type http as you can see is it is not a valid filter.
It is a valid display filter, but an invalid capture filter.
So guys, when you want to use application layer protocols as the capture filters, then you have to
specify port at the beginning.
So right boot space as http.
Now as you can see, guys, this is a valid filter.
Right now, this filter is only going to save or capture the HTTP traffic.
So let me click on START.
Let me refresh, read it.
As you can see, guys, since Reddit is an HTTPS website, then it is not saving the encrypted or actually
HTTP as traffic because we have told Wireshark only to capture the HTTP traffic.
Now let me visit an HDP website.
As you can see, guys, now it is capturing the HTTP traffic right now back to the capture options window
in the same way you can capture, let's say SSH or FTP and this filter is only going to capture the
FTP traffic.
Now let's combine multiple filters.
Now let's say I want to capture FTP and SSH traffic so I can type port FTP, SSL or POP3 or SMTP.
Now this filter is going to capture SMTP three SSH and FTP traffic.
Right.
Now let's capture a secure or HTTPS traffic so we'll type PWD and simply edge to http sw.
Now this filter is only going to save the encrypted or HTTPS traffic.
Now instead of writing the service name like HTTPS or FTP, we can write the port number where the service
runs.
For example, FTP runs on port number 21.
Right?
So if I type port 21, then it is going to produce the same result as port FTP.
And port for search is 22 and FTP runs on port number eight zero.
So this filter is going to capture all the HTTP traffic.
Now if I type port DNS, as you can see, this is not a valid filter, right?
Even though the ANS is also an application layer protocol.
Wireshark doesn't allow some application layer protocols to be used as the capture filters like DNS
or D edge CP.
So in such cases, all you have to do is write the port number.
So port number for a DNS is 53.
Now this filter is going to capture all the DNS traffic, right.
And in the same way, port number for TCP is 67.
So whenever you come up with such situations where a protocol name doesn't work, just write the port
number, not the service that the port runs.
As simple as that.