1

Apologies ahead of time if I missed an article or a posting with the answer to this question...

I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple display filters without having it all clumped in the overhead one line filter field.

Currently its set to a long string of '!(ipv6.src == xxxx::xxxx:x... or ip.dst == xxx.xxx... or arp or lldp or ...)'. I'd like to know if there a way of creating kind of a separate file with a nicely formatted list of all the 'noise' I want tucked away so that I only see sneaky traffic. That or if there is a better method of filter large quantities of known connections so that I only see what I want to see.

Thank you much!

EDIT:

Thanks to Jaap Keuter for the pointer on Wireshark Display Filter Macros. There seems to be some thin documentation online from what I could find after some short searches, this is what I've found:

This has a pretty good write up on Display Filter Macros https://support.cloudshark.org/administrator-guide/display-filter-macros.html

In Wireshark go to 'Analyze' > 'Display Filter Macros...'

For 'Name' type a name for your macro which you will later use to call it. For 'Text' type in your query e.g. '!(ip.src == 192.168.2.1 or arp or lldp)' or if you prefer something like '!(ip.src == $1 or ip.src == $2)' where $# is an item you will fill later when calling the macro.

Example used later on:

Name: 'Nonlocal' Text: '!(ip.src >= $1 && ip.src <= $2)'

Calling the Macro:

In Wireshark, where the 'Apply a display filter... ' appears type in ${YourMacroName} if it has no variables to pass on.

If there are variables to pass on in the case of '!(ip.src == $1 or ip.src == $2)' then type the following when calling your macro '${YourMacroName:Value1;Value2}'

Example from before in action: ${NonLocal:192.168.2.0;192.168.2.255}

EDIT#2

Combining several Display Filter Macros is fairly simple, after a quick test I found that using && allows you to run multiple Macros at once. e.g: '${Macro1} && ${Macro2}'

Hope that helps someone.

Improve this question
2
  • 1
    You should submit that to Wireshark as an enhancement.
    – Ron Maupin ♦
    Dec 19, 2016 at 3:18
  • Set up big filters to run from the command line. You can prepare them in any format you like and then write a script that concatenates it into an expression that's wireshark/tshark friendly.
    – rnxrx
    Dec 19, 2016 at 5:40

1 Answer 1

Reset to default
-1

First of all, for Wireshark questions you should try your luck at Wireshark Q&A.

But since were here I could point you to using display filter macros. These form a single word representation of your filter expression, even with parameters, if you which.

So '!(ipv6.src == xxxx::xxxx:x... or ip.dst == xxx.xxx... or arp or lldp or ...)' could become '${NotThatStuff}'.

Improve this answer
4
  • Thanks, just tried it. It's a lot closer then when I first started and it seems like it will help quite a bit. I appreciate the direction.
    – BeepBoopBeep
    Dec 19, 2016 at 19:01
  • 1
    To make this a good answer you should add some guideline on how to actually construct such a macro.
    – hertitu
    Dec 19, 2016 at 20:04
  • @hertitu check out my latest edit on the main post, I added some ways to build those macros.
    – BeepBoopBeep
    Dec 19, 2016 at 20:35
  • @BeepBoopBeep: thank you, better still would be to either edit Jaap's answer, or submit your own answer. In any case, the info is there now for others to find, thanks.
    – hertitu
    Dec 21, 2016 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.