A bit advanced filter

Question

Hello, in the Wireshark filter I can display all packets destined to 10.0.0.1 address:

ip.dst == 10.0.0.1

After that Wireshark will show a lot of packets with different IP source addresses. It is clear.

But how can I display pakets with other IP destinations with exactly above IP sources (if there are)? I can check each IP source but it is long and time consuming process.

Simply: "display packets destined to 10.0.0.2, but only these having the same source addresses which we can find in another packets source addresses destined to 10.0.0.1"

Accepted Answer

so, you want to do this:

100.100.100.100 -> 10.0.0.1
200.200.200.200 -> 10.0.0.1

then create a filter that shows only frames from 100.100.100.100 and/or 200.200.200.200 to 10.0.0.2, like the marked frames below.

100.100.100.100 -> 10.0.0.2
1.2.3.4 -> 10.0.0.2
10.1.1.1 -> 10.0.0.2
200.200.200.200 -> 10.0.0.2

That is not possible with a simple display filter, as it would require a conditional filter, based on attributes of other frames.

What you can do:

Run tshark to find all source addresses. Then build a display filter with those list and apply that filter in Wireshark.

Linux: tshark -nr input.pcap -Y "ip.dst == 10.0.0.1" -T field -e ip.src | sort -u

You will get the following list:

100.100.100.100
200.200.200.200

Now create the display filter

(ip.addr eq 100.100.100.100 and ip.addr eq 10.0.0.2) or (ip.addr eq 200.200.200.200 and ip.addr eq 10.0.0.2)

or

ip.addr eq 10.0.0.2 and (ip.addr eq 100.100.100.100 or ip.addr eq 200.200.200.200)

With a small script you should be able to automate this process.

Regards
Kurt

Answer 2

That's what the conversation statistics is used for. Filter on either source or destination you want, and then use the conversation statistic with "Limit to display filter" checked. Go to the "IPv4" tab and you'll see all addresses the filtered address talks to. You can then either export that list, or filter from there on specific connections by using the popup menu.