Quoting Chuck B <chuckbowling@xxxxxxx>:
I'm new to Wireshark and not all that familiar with network protocols
in general.
Is it possible to filter everything from a capture session but only the
things specific to that capture session?
To clarify; I want to study all of the interactions that an app has
with multiple servers and multiple ports. But, there are a lot of
packets mixed in with the capture that don't have anything to do with
the apps interactions.
What I want to do is shut down all unnecessary traffic on my system
then capture all of the traffic between my ethernet card, router, and
ISP. After the capture I want to filter everything that has been
captured including all ARP, DNS, DHCP etc.. However, I don't want to
make the filter too generic and have it filter things that I want to
see.
Once I have a list of all interactions I want to start another capture
using the filter, open my app, and watch the interactions between it
and whatever servers it connects to.
Is that possible? And, if so, what is the easiest way to achieve that goal?
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
Chuck-
From time to time I troubleshoot applications that have problems
communicating with the Internet.
Although it makes sense to apply filters to your capture, you just
never know what vital piece of information you would end up missing by
doing so.
I personally do *not* apply filters to Wireshark or tcpdump captures
and later piece the communication streams with display filters.
They're many ways to accomplish what you're looking to do. When I am
met with an overly large capture I just extract streams and join them
all together.
A handful of people I know use the Wireshark configuration profiles
which I think ultimately its what you are looking for.
Have a look at the link: Customizing Wireshark and hope you find it useful.
http://www.wireshark.org/docs/wsug_html_chunked/ChCustConfigProfilesSection.html
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
