網絡分析Wireshark常見filter指令及描述

Filter	篩選用途描述
eth.addr / eth.dst / eth.src	MAC
rip.auth.passwd	RIP password
ip.addr / ip.dst / ip.src	IP
tcp.port / tcp.dstport / tcp.srcport	TCP ports
tcp.flags(ack, fin, reset, syn…)	TCP flags
udp.port / udp.dstport / udp.srcport	UDP ports
http.authbasic	Basic authentication
http.www_authentication	HTTP authentication
http.data	HTTP data portion
http.cookie	HTTP cookie
http.referer	HTTP referer
http.server	HTTP server
http.user_agent	HTTP user agent
wlan.fc.type eq 0	802.11 management frame
wlan.fc.type eq 1	802.11 control frame
wlan.fc.type eq 2	802.11 data frame
wlan.fc.type_subtype eq 0 (1=response)	802.11 association request
wlan.fc.type_subtype eq 2 (3=response)	802.11 reassociation request
wlan.fc.type_subtype eq 4 (5=response)	802.11 probe request
wlan.fc.type_subtype eq 8	802.11 beacon
wlan.fc.type_subtype eq 10	802.11 disassociate
wlan.fc.type_subtype eq 11 (12=deauthenticate)	802.11 authenticate

比較運算符	比較運算符
eq	==
ne	!=
gt	>
lt	<
ge	>=
le	<=

邏輯運算符	邏輯運算符
and	&&
or	｜｜
xor	^^
not	!