Skip to content
This repository has been archived by the owner on Aug 7, 2021. It is now read-only.

tshark flags for different protocols (Valuable information)

Badrocklo edited this page Mar 27, 2015 · 3 revisions

flag = Example value

filters : wps.device_name!="" and wps.device_name!=" " and wps.model_number!="" and wps.model_number != " " and wps.manufacturer!="" and wps.manufacturer != " " and wlan_mgt.ssid=="" wps.model_number = Nexus 4 wps.model_name = Nexus 4 wps.manufacturer = LGE wps.device_name = occam wlan_mgt.tag.oui = 20722,20722,5271450 (Microsoft, Microsoft, Wifi for all)

filter : wlan.fc.type_subtype == 4 and wlan_mgt.ssid != "" wlan_mgt.ssid = Aerius

Bonjour, filter : dns.ptr.domain_name != "" dns.ptr.domain_name = HostName

LLMNR -> udp.port == 5355 dns.qry.name = HostName

DNS, filter : udp.port == 53 and dns.qry.name != "" dns.qry.name = Visited website

http.request.full_uri = http://www.dell.com// http.referer = http://www.lemonde.fr/international/article/2015/03/06/l-etat-islamique-saccage-des-ruines-d-une-cite-historique-en-irak_4588449_3210.html

Text html : filter : data-text-lines

tshark -r aerius.pcap -2 -T fields -R http -e text

Clone this wiki locally