Wireshark数据分析与处理操作

过滤IP，如源IP或者目标 x.x.x.x
ip.src == x.x.x.x or ip.dst eq x.x.x.x 或者 ip.addr == x.x.x.x
过滤端口
tcp.port eq 80 or udp.port eq 80
过滤MAC
eth.dst ==A0:00:00:04:C5:84

http模式过滤(就是一种模糊匹配)
http.request.method== "GET" 
http.request.method== "POST" 
http.request.uri =="/img/logo-edu.gif" 
http contains"GET" 
http contains"HTTP/1." 
http.request.method== "GET" && http contains "User-Agent:"

#过滤登录后台
登陆后台是(相对路径即可) /admin/login.php
http contains "login" && http.request.method == "POST"

#登录密码
http contains "password"
ip.src == 192.168.94.59 and http contains "eval"
http contains "{\"success\":true}" and ip.addr==192.168.94.59

网卡配置是是什么，提交网卡内网ip
http contains "eth" 

#协议分级统计 mysql类似的模糊匹配
mysql.query contains “SELECT”
mysql contains "hash_code"

接点击统计->端点

# 按照其规律进行过滤
# Request - 请求
ip.src==10.20.172.103 && ip.dst==192.168.10.200
# Response - 响应
ip.dst==10.20.172.103 && ip.src==192.168.10.200

# 数据包大小计算
211 * 187.09 / 1024 = 38.55 kb(注意大小KB区别)
228 * 3661.07 /1024 = 815.16 kb