Difference between revisions of "Wireshark: Filter TCP/IP Packet"

From OnnoWiki
Jump to navigation Jump to search
(New page: Filtering TCP/IP packets with Wireshark February 2, 2011 Leave a Comment Lately I’ve been involved in a project that required the creation of a TCP/IP server. This server will be hit b...)
 
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
−
Filtering TCP/IP packets with Wireshark
+
Untuk mengetahui masalah yang ada di jaringan, akan lebih mudah jika kita dapat menyadap menggunakan wireshark dan memfilter hanya packet tertentu saja yang di sadap.
  
−
February 2, 2011 Leave a Comment
+
LANGKAH PERTAMA: Untuk bisa menyadap dengan wireshark. Masuk ke menu Capture > Interface. Klik 'Start' untuk mulai menangkap packet.
  
−
Lately I’ve been involved in a project that required the creation of a TCP/IP server. This server will be hit by large numbers of embedded devices. I created unit tests to test the server. But when the time came to integrate with the embedded device (which has been produced by a third party), of course there were still issues arising. You can try to log everything in your server, but using a packet sniffer like Wireshark is much more effective in finding the reasons why certain issues arise.
+
LANGKAH KEDUA:
  
−
Although Wireshark is pretty easy to use, at first glance the interface looks daunting. Here are a few tricks that got me up and running with Wireshark.
+
==Port Filter==
  
−
First: how to start capturing? Capture->Interfaces. In this dialog click ‘Start’ on the interface that displays the external ip address your server is running on. You will see packets pouring in after this. Now you can set up a filter to display only the packets you’re interested in.
+
Mem-filter packet kita perlu menset beberapa parameter. Misalnya, kita ingin menampilkan hanya traffic ke port 8080,
  
−
Suppose your server is running on port 8080. Displaying only the traffic that is going back and forth on that port is as simple as setting a filter:
 
  
−
tcp.port == 8080
+
tcp.port == 8080
  
−
Now suppose you only want to see the data that is being sent from the embedded devices to your server.
+
Misalnya, kita ingin melihat hanya packet yang menuju port 8080,
  
−
tcp.destport = 8080
+
tcp.destport = 8080
  
−
Should you want to see the data that is being sent from the server to the embedded device:
+
Atau di balik, kita ingin melihat data dari server yang bekerja pada port 8080,
  
−
tcp.srcport = 8080
+
tcp.srcport = 8080
  
−
So tcp.port == 8080 equals to tcp.srcport == 8080 || tcp.dstport == 8080
+
Bisa kita buat misalnya,
  
−
Now what if we wanted to know only about data coming from the ip adress of one embedded device (assuming a static ip address over time):
+
tcp.port == 8080
  
−
ip.src == 80.80.80.80
+
yang artinya sama dengan
  
−
Just as with the port you can filter only packets coming from any embedded device to the server:
+
tcp.srcport == 8080 || tcp.dstport == 8080
  
−
ip.dst == 80.80.80.80
 
  
−
and if you’re indifferent about the direction:
+
==IP address Filter==
  
−
ip.addr == 80.80.80.80
+
Jika kita ingin menangkap hanya packet yang dikirim dari IP tertentu saja,
  
−
There will be a lot of ceremony packets going back and forth (opening/closing connections, etc…). Usually you’re especially interested in the packets containing data. How to display only the packets containing data:
+
ip.src == 80.80.80.80
  
−
tcp.len > 0
+
Atau IP address tujuan tertentu saja,
  
−
How do I display only packets containing a certain byte in the payload:
+
ip.dst == 80.80.80.80
  
−
data[0] == A0
+
atau jika kita tidak peduli arah yag dituju,
  
−
It is common to log certain events in a server using for example log4net. These events will have a timestamp based on the datetime of the server. As Wireshark by default shows relative times this doesn’t match very well. See View->Time Display Format. There you will find Date and Time of Day. After selecting this, the date and time will be shown in the Frame part of the packet. Now suppose you would want to filter on a certain timestamp you could use, which would show all packets sent and received in a specific timespan (allowing you to match this with the events logged in the server):
+
ip.addr == 80.80.80.80
  
−
frame.time >= 'Feb 1, 2011 11:00:00' && frame.time < 'Feb 1, 2011 11:05:00'
 
  
−
Combining this delivers a powerful way to find information.
+
==Filter Data Tertentu==
  
−
For example, show all packets coming from the embedded device connecting on port 8080, between 11:00 and 11:05 February 1st 2011, coming from ip adress 80.80.80.80, containing data, where the data is only of a certain type:
+
Biasanya ada banyak paket yang dikirim. Agar hanya packet yang berisi data saja yang di tampilkan, kita dapat mem-filter,
  
−
tcp.destport == 8080 &&
+
tcp.len > 0
−
frame.time >= 'Feb 1, 2011 11:00:00' &&
 
−
frame.time < 'Feb 1, 2011 11:05:00' &&
 
−
ip.src == 80.80.80.80 &&
 
−
tcp.len > 0 &&
 
−
data[0] == A0
 
  
−
Finally, you can export the data of the displayed packets and analyse them further with the parser belonging to your server.
+
Atau jika kita ingin hanya menampilkan data yang berisi byte tertentu,
−
frame.time >= ‘Feb 1, 2011 11:00:00′ && frame.time < 'Feb 1, 2011 11:05:00'
 
  
−
Filed under Wireshark Tagged with introduction, network, sniffer, tcp/ip, wireshark
+
data[0] == A0
  
−
Leave a Reply
+
Atau jika kita ingin menampilkan hanya data pada selang waktu tertentu saja,
  
−
Your email address will not be published. Required fields are marked *
+
frame.time >= 'Feb 1, 2011 11:00:00' && frame.time < 'Feb 1, 2011 11:05:00'
−
 
 
−
Name *
 
−
 
 
−
Email *
 
−
 
 
−
Website
 
−
 
 
−
Comment
 
−
 
 
−
You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>
 
  
 +
==Kombinasi Filter==
  
 +
Kita bisa mengkombinasikan berbagai filter tersebut dengan tanda &&, misalnya,
  
 +
tcp.destport == 8080 &&
 +
frame.time >= 'Feb 1, 2011 11:00:00' &&
 +
frame.time < 'Feb 1, 2011 11:05:00' &&
 +
ip.src == 80.80.80.80 &&
 +
tcp.len > 0 &&
 +
data[0] == A0
  
 +
Kita dapat mengeksport data tersebut untuk di analisa lebih lanjut.
  
  

Latest revision as of 11:16, 18 April 2017

Untuk mengetahui masalah yang ada di jaringan, akan lebih mudah jika kita dapat menyadap menggunakan wireshark dan memfilter hanya packet tertentu saja yang di sadap.

LANGKAH PERTAMA: Untuk bisa menyadap dengan wireshark. Masuk ke menu Capture > Interface. Klik 'Start' untuk mulai menangkap packet.

LANGKAH KEDUA:

Port Filter

Mem-filter packet kita perlu menset beberapa parameter. Misalnya, kita ingin menampilkan hanya traffic ke port 8080, 


tcp.port == 8080

Misalnya, kita ingin melihat hanya packet yang menuju port 8080, 

tcp.destport = 8080

Atau di balik, kita ingin melihat data dari server yang bekerja pada port 8080, 

tcp.srcport = 8080

Bisa kita buat misalnya, 

tcp.port == 8080

yang artinya sama dengan 

tcp.srcport == 8080 || tcp.dstport == 8080


IP address Filter

Jika kita ingin menangkap hanya packet yang dikirim dari IP tertentu saja, 

ip.src == 80.80.80.80

Atau IP address tujuan tertentu saja, 

ip.dst == 80.80.80.80

atau jika kita tidak peduli arah yag dituju, 

ip.addr == 80.80.80.80


Filter Data Tertentu

Biasanya ada banyak paket yang dikirim. Agar hanya packet yang berisi data saja yang di tampilkan, kita dapat mem-filter, 

tcp.len > 0

Atau jika kita ingin hanya menampilkan data yang berisi byte tertentu, 

data[0] == A0

Atau jika kita ingin menampilkan hanya data pada selang waktu tertentu saja, 

frame.time >= 'Feb 1, 2011 11:00:00' && frame.time < 'Feb 1, 2011 11:05:00'

Kombinasi Filter

Kita bisa mengkombinasikan berbagai filter tersebut dengan tanda &&, misalnya, 

tcp.destport == 8080 &&
frame.time >= 'Feb 1, 2011 11:00:00' &&
frame.time < 'Feb 1, 2011 11:05:00' &&
ip.src == 80.80.80.80 &&
tcp.len > 0 &&
data[0] == A0

Kita dapat mengeksport data tersebut untuk di analisa lebih lanjut.


Referensi

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=Wireshark:_Filter_TCP/IP_Packet&oldid=47681"