Wireshark Info Filter Help

Question

I have looked all over the net for a tutorial on how to filter the info column but cant find any that makes sense.

I want to filter all logs where the info column contains the text "insitu-conf" but cant find out how. Help please.

Answer 1

You actually can't do this directly. The info column is decoded based on the properties of the packet, though, and you can filter on these which will have exactly the same effect. The only difference is you have to figure out what info wireshark is using to create that info line, which may be non-intuitive.

In this example, 'insitu-conf' is a port alias for port 1490 (grep insitu-conf /etc/services) and so wireshark is telling you that this is a packet from remote port 51811 to local port 1490. Thus, the filter to caputre those packets would be 'dst port=1490'.

In other instances, there may be a more descriptive info line which is derived from several properties of the packet, including the port and some of the data -- for instance, http requests on port 80 will have an info line that actually includes the first line of the http request.

Answer 2

Are you looking for capture filters or display filters? Is "insitu-conf" a hostname?

Edit:

Looks like insitu-conf is port 1490, so a simple filter like:

tcp.port == 1490 || udp.port == 1490

Should do the trick.

Answer 3

You can use Microsoft Network Monitor to do the trick.

Open your file in Microsoft Network Monitor.
Right-click on an item in the Description column en choose "Add 'Description' to Display Filter" from the context menu.
The Display Filter is added to the Filter Window.
Hit the Apply button on the filter toolbar.

Examples:

Description == "HTTP:Request, GET / "
Description.contains("Request")
Description.contains("insitu-conf")

http://www.lovemytool.com/blog/2011/03/microsoft-network-monitor-34-search-the-description-column-by-joke-snelders.html

Answer 4

http.request.uri matches "insitu-conf" should also work.