Wireshark

Wireshark is an incredible tool to analyze network traffic.

Capture filtering

See CaptureFilters. Syntax is different from display filters.

To avoid big memory use, prefer filtering when capturing.

Use and or not and parenthesis to combine filters.

Typical filters are:

• tcp and port 80
• udp and (port 8000 or port 8002)
• host 232.128.12.3
• igmp
• icmp

Display Filter

See DisplayFilters. Syntax is different from capture filters.

They can be created from packets : select a packet, right-click, and select as filter.

Typical filters are :

• ip.addr==192.168.1.12
• tcp.port==80
• tcp.flags.push==1
• vlan && udp
• _ws.expert.severity select packets with a detected error

Decoding

To choose a decoder, right-click on one packet, and choose "Decode as...".

Then select the field that will select the dissector (TCP port, UDP port, RTP payload type, ...), choose the value, and select the decoder in Current column.

Choose Save to keep the changes for next launch.

Adding dissectors

A dissector is a protocol analyzer. It can be written in LUA.

You can put your lua scripts in

• Linux: $HOME/.config/wireshark
• Windows: %AppData%\Wireshark\plugins or %ProgramFiles%\Wireshark\plugins (folders are shown in Help–>About Wireshark–>Folders)

For Linux, you need to add a init.lua script that will load them with dofile("myfile.lua"), in Windows it loads all present in the folder.

In recent versions of Wireshark, LUA bitop can be used directly.

Useful dissectors

ST2026

ST2022_Dissector.lua

Select the "RTP Payload type" to ST2022-6 for ProMPEG FEC.

The stream must be first decoded as RTP.

ULP-FEC (RFC 5109)

ulpfec.lua

Select the "RTP Payload type" to ULPFEC for RFC 5109 FEC.

The stream must be first decoded as RTP.

MPEG-TS Dump

mpeg_packets_dump.zip

Use Tools->Dump MPEG TS Packets to export the MPEG-TS stream to a file.

UltraVox 2.1 (Shoutcast 2)

uvox21.lua

For TCP stream, use UVOX21.

ADTS

adts.lua

For UDP/TCP stream, use ADTS.