Right click on a TCP session then Follow > TCP Stream, the result is a Wireshark display filter that shows only the packets in this sessionĪnother way to do the same is by using the “Conversations” list which can be accessed through “Statistics > Conversations” then you can sort the conversation list by bytes or number of packets in each direction or by totals which can be very useful. After that, you could just right click any packet in a TCP conversation of interest and do a quick “Follow TCP Stream” A quick method to zoom in on particular peers without knowing a specific session is to apply a wireshark display filter with both peer IP’s, this will show all conversations between those peers, for example: So how to find the specific session of interest? When you already know both TCP session peer IP’s Port filter will make your analysis easy to show all packets to the selected port.Troubleshooting a specific TCP session in a Wireshark packet capture should be an easy or difficult task depending on the nature of the problem that’s being investigated, what can be cumbersome is actually finding that session in the middle of a huge capture file or even a running capture with lots of packets. In case there is no fixed port then system uses registered or public ports. Now we put “udp.dstport = 67 || udp.dstport = 68” as Wireshark filter and see only DHCP related packets.įor port filtering in Wireshark you should know the port number. When we run only UDP through Iperf we can see both source and destination ports are used from registered/public ports.ĥ. Now we put “tcp.port = 443” as Wireshark filter and see only HTTPS packets. Now we put “udp.port = 53” as Wireshark filter and see only packets where port is 53.ģ. Here 192.168.1.6 is trying to send DNS query. Now we put “tcp.port = 80” as Wireshark filter and see only packets where port is 80.Ģ. Here 192.168.1.6 is trying to access web server where HTTP server is running. Ports 1024 to 49151 are Registered Ports.īefore we use filter in Wireshark we should know what port is used for which protocol.

In this article we will try to understand some well know ports through Wireshark analysis. To know more about filter by IP in Wireshark, please follow below link:

Port filtering is the way of filtering packets based on port number.

Wireshark filter http session