This is our old Q&A Site. Please post any new questions and answers at

Is there an efficient way in Wireshark to search for a particular packet sequence in a capture file? For example, I want to search for a sequence of three consecutive packets, where: packet 1 is a first particular type of packet, packet 2 is a second particular type of packet, and packet 3 is a third particular type of packet.

asked 31 May '12, 08:57

Kali's gravatar image

accept rate: 0%

You cannot search for a "sequence", but you can combine display filters with or to get almost the same result. contains "" or (http.request and contains "") or (icmp and ip.addr eq

This will show:

  1. the dns request to *
  2. then the HTTP Request to that site
  3. and then a ping to one IP address of facbook

That's the only way of doing it, without Lua. If you tell us a bit more about your usecase (pattern to match), we might be able to give more detailed "instructions".

With Lua, you can create a Listener and look for whatever criteria you are interested. However that requires programming skills or somebody to do it for you.


permanent link

answered 31 May '12, 09:27

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 31 May '12, 09:34

Thanks much for the response, Kurt. Maybe Lua is the answer. In particular, I am looking for an efficient way to search a huge wlan capture file for the following packet sequence: 1) Beacon packet with non-zero TIM; 2) Null Function packet with PM bit clear; 3) ACK; 4) Data packet; 5) ACK.

(31 May '12, 10:16) Kali

O.K. is one criteria the order of the packets, meaning: do they have to appear in the order to be a valid match? If so, Lua is one way to do it. However, it requires some programming skills to write that script. Another way would be tshark with a display filter that matches all of those conditions (like my facebook example) and some script (Perl, bash, ) to filter out only those packets that appear in the defined order.

(31 May '12, 10:30) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 31 May '12, 08:57

question was seen: 2,074 times

last updated: 31 May '12, 10:34

p​o​w​e​r​e​d by O​S​Q​A