{"id":1075,"date":"2026-09-09T12:34:39","date_gmt":"2026-09-09T10:34:39","guid":{"rendered":"https:\/\/whoami.lausitz-event.info\/?p=1075"},"modified":"2026-09-09T12:35:41","modified_gmt":"2026-09-09T10:35:41","slug":"wireshark-filter","status":"publish","type":"post","link":"https:\/\/whoami.lausitz-event.info\/?p=1075","title":{"rendered":"Wireshark – Filter"},"content":{"rendered":"

N\u00fctzliche Wireshark-Filter<\/h1>\n\n

Eine \u00dcbersicht der wichtigsten Wireshark-Filter f\u00fcr die t\u00e4gliche Netzwerkanalyse.<\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Wireshark-Filter<\/th>\n Beschreibung<\/th>\n <\/tr>\n <\/thead>\n
ip.addr == 10.0.0.1<\/code><\/td>\n Zeigt gesamten Traffic, bei dem 10.0.0.1 entweder Quelle oder Ziel ist.<\/td>\n <\/tr>\n
ip.addr == 10.0.0.0\/24<\/code><\/td>\n Zeigt gesamten Traffic zu und von jeder Adresse im Bereich 10.0.0.0\/24.<\/td>\n <\/tr>\n
ip.src == 10.0.0.1 && ip.dst == 10.0.0.2<\/code><\/td>\n Zeigt gesamten Traffic von 10.0.0.1 zu 10.0.0.2.<\/td>\n <\/tr>\n
!(ip.addr == 10.0.0.1)<\/code><\/td>\n Schlie\u00dft gesamten Traffic zu oder von 10.0.0.1 aus.<\/td>\n <\/tr>\n
icmp.type == 3<\/code><\/td>\n Zeigt ICMP-Pakete vom Typ \u201eDestination Unreachable\u201c.<\/td>\n <\/tr>\n
tcp or udp<\/code><\/td>\n Zeigt TCP- oder UDP-Traffic.<\/td>\n <\/tr>\n
tcp.port == 80<\/code><\/td>\n Zeigt TCP-Traffic auf Port 80.<\/td>\n <\/tr>\n
tcp.srcport < 1000<\/code><\/td>\n Zeigt TCP-Traffic mit einem Quellport unterhalb von 1000.<\/td>\n <\/tr>\n
http or dns<\/code><\/td>\n Zeigt gesamten HTTP- oder DNS-Traffic.<\/td>\n <\/tr>\n
tcp.flags.syn == 1<\/code><\/td>\n Zeigt TCP-Pakete mit gesetztem SYN-Flag.<\/td>\n <\/tr>\n
tcp.flags == 0x012<\/code><\/td>\n Zeigt TCP-Pakete mit gesetzten SYN- und ACK-Flags.<\/td>\n <\/tr>\n
tcp.analysis.retransmission<\/code><\/td>\n Zeigt alle erneut \u00fcbertragenen (retransmittierten) TCP-Pakete.<\/td>\n <\/tr>\n
http.request.method == \"GET\"<\/code><\/td>\n Zeigt Pakete, die zu HTTP-GET-Anfragen geh\u00f6ren.<\/td>\n <\/tr>\n
http.response.code == 404<\/code><\/td>\n Zeigt Pakete mit HTTP-404-Antwort.<\/td>\n <\/tr>\n
http.host == \"www.abc.com\"<\/code><\/td>\n Zeigt HTTP-Traffic, der auf das Host-Header-Feld passt.<\/td>\n <\/tr>\n
tls.handshake<\/code><\/td>\n Zeigt ausschlie\u00dflich TLS-Handshake-Pakete.<\/td>\n <\/tr>\n
tls.handshake.type == 1<\/code><\/td>\n Zeigt das Client-Hello-Paket w\u00e4hrend des TLS-Handshakes.<\/td>\n <\/tr>\n
dhcp and ip.addr == 10.0.0.0\/24<\/code><\/td>\n Zeigt DHCP-Traffic f\u00fcr das Subnetz 10.0.0.0\/24.<\/td>\n <\/tr>\n
dhcp.hw.mac_addr == 00:11:22:33:44:55<\/code><\/td>\n Zeigt DHCP-Pakete f\u00fcr die angegebene Client-MAC-Adresse.<\/td>\n <\/tr>\n
dns.resp.name == cnn.com<\/code><\/td>\n Zeigt DNS-Antworten mit dem Namensfeld \u201ecnn.com\u201c.<\/td>\n <\/tr>\n
frame contains keyword<\/code><\/td>\n Zeigt alle Pakete, die das Wort \u201ekeyword\u201c enthalten.<\/td>\n <\/tr>\n
frame.len > 1000<\/code><\/td>\n Zeigt alle Pakete mit einer Gesamtl\u00e4nge \u00fcber 1000 Byte.<\/td>\n <\/tr>\n
eth.addr == 00:11:22:33:44:55<\/code><\/td>\n Zeigt gesamten Traffic zu oder von der angegebenen MAC-Adresse.<\/td>\n <\/tr>\n
eth[0x47:2] == 01:80<\/code><\/td>\n Filtert Ethernet-Frames, bei denen 2 Byte am Offset 0x47 gleich 01:80 sind.<\/td>\n <\/tr>\n
!(arp or icmp or stp)<\/code><\/td>\n Filtert Hintergrund-Traffic von ARP, ICMP und STP heraus.<\/td>\n <\/tr>\n
vlan.id == 100<\/code><\/td>\n Zeigt Pakete mit der VLAN-ID 100.<\/td>\n <\/tr>\n <\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

N\u00fctzliche Wireshark-Filter Eine \u00dcbersicht der wichtigsten Wireshark-Filter f\u00fcr die t\u00e4gliche Netzwerkanalyse. Wireshark-Filter Beschreibung ip.addr == 10.0.0.1 Zeigt gesamten Traffic, bei dem 10.0.0.1 entweder Quelle oder Ziel ist. ip.addr == 10.0.0.0\/24 Zeigt gesamten Traffic zu und von jeder Adresse im Bereich 10.0.0.0\/24. ip.src == 10.0.0.1 && ip.dst == 10.0.0.2 Zeigt gesamten Traffic von 10.0.0.1 zu 10.0.0.2. […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[15,3,12,23,13,11],"tags":[],"class_list":["post-1075","post","type-post","status-publish","format-standard","hentry","category-cisco","category-it","category-linux","category-netzwerk","category-netzwerke","category-security"],"_links":{"self":[{"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/posts\/1075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1075"}],"version-history":[{"count":2,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/posts\/1075\/revisions"}],"predecessor-version":[{"id":1077,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=\/wp\/v2\/posts\/1075\/revisions\/1077"}],"wp:attachment":[{"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/whoami.lausitz-event.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}