Wireshark: IP Octet Capture Filter
One of the most powerful features of any protocol analyzer is the ability to capture or filter down to the byte or bit. This procedure goes by many names but all reference the words ‘Pattern Offset’ or ‘Data Offset.’
The word offset may seem a bit overwhelming, but the concept is very straightforward. You identify what you want to filter on which is referred to as the ‘data’ or ‘pattern.’ The second part is to determine where the data or pattern is in the packet, which is referred to the ‘offset.’
The offset can get a bit confusing since you need to pay attention to where you are starting your offset. This is based on which filter you decide to use. For example, you could start your offset from the Ethernet frame, IP, TCP, or UDP header.
In the video below, I walk you through how to configure a capture filter that will capture packets that have 180 as the last octet.
This same technique may be used to capture packets with specific application signatures, viruses, worms, and more. Try it out, and you will soon see that this isn't as complicated as you might think.
Recommended For You
IBN is set to take network management to the next level. Is your organization ready to join the ride?
We have updated the Network Computing site to make it easier to find the information you need. Please take a look at our new features.
Low-Power WANs offer an alternative to 5G for connecting a fast-growing array of basic devices and sensors that transmit small amounts of data.
An effective network visibility strategy requires understanding the technical, financial, political, and legal aspects impacting your network operations.
Emerging organizational structures for IT include placement of IT pros in user areas and departments forming their own "micro IT's."
Comparing a good and bad trace helps identify performance issues. Dynamic baselining can be used when you do not have a good trace to reference.