Search My Techie Guy

Thursday, January 27, 2022

Quick Check - Common WireShark Filters When Troubleshooting Network/Communication Problems

Here is a list of commonly used WireShark filters for network and systems engineers when analyzing packet dumps:

1) Filtering DNS packets according to their "return code" (rcode):

(dns.flags.rcode == x) //Filter dns packets whose rcode is equal to "x".
!(dns.flags.rcode == x) //Filter dns packets whose rcode is NOT equal to "x".


See common "return codes" and their description in the table below:

Return Message

RCODE

Description

NOERROR

0

DNS Query completed successfully

FORMERR

1

DNS Query Format Error

SERVFAIL

2

Server failed to complete the DNS request

NXDOMAIN

3

Domain name does not exist.

NOTIMP

4

Function not implemented

REFUSED

5

The server refused to answer for the query

YXDOMAIN

6

Name that should not exist, does exist

XRRSET

7

RRset that should not exist, does exist

NOTAUTH

8

Server not authoritative for the zone

NOTZONE

9

Name not in zone


2) Filtering packets based on Source and Destination IP Addresses:

(ip.src == 31.13.64.11) && (ip.dst == 10.210.0.10)


3) Filtering M3UA packets based on Origination Point Code (OPC): 

(m3ua.protocol_data_opc == 12345) //Filter M3UA packets whose OPC is equal to "12345".

4) Filtering M3UA packets based on Destination Point Code (DPC): 

(m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose DPC is equal to "34567".

5) Filtering M3UA packets based on OPC or DPC: 

(m3ua.protocol_data_opc == 12345) || (m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose OPC is equal to "12345" OR DPC is equal to "34567".

(m3ua.protocol_data_opc == 12345) && (m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose OPC is equal to "12345" AND DPC is equal to "34567".

6) Filtering GSM MAP packets based on TBCD (Telephony Binary-Coded Decimal) digits: 

(gsm_map.tbcd_digits == "1234567") //Filter GSM MAP packets whose TBCD is equal to "1234567".

7) Filtering TCP/UDP packets based on port number

(tcp.port == 8080) //Filter TCP packets whose source or destination port number is equal to "8080".
(tcp.srcport == 80) //Filter TCP packets whose source port number is equal to "80".
(tcp.dstport == 443) //Filter TCP packets whose source or destination port number is equal to "443".
(udp.port == 53) //Filter UDP packets whose source or destination port number is equal to "53".
(udp.srcport == 53) //Filter UDP packets whose source port number is equal to "53".
(udp.dstport == 53) //Filter UDP packets whose destination port number is equal to "53".


8) Filtering TCAP (Transaction Capabilities Application Part) packets based on OTID (Orig. Transaction Id)/DTID (Dest. Transaction Id)

(tcap.otid == 1a:00:6a:15) //Filter TCAP packets whose otid is equal to "1a:00:6a:15".
(tcap.dtid == 1a:00:6a:15) //Filter TCAP packets whose dtid is equal to "1a:00:6a:15".

9) Filtering Voice packets based on E.164 international telephone numbering plan:   

(e164.calling_party_number.digits == "256723039294") //Filter voice packets whose calling party (A)is equal to "256723039294".
(e164.called_party_number.digits == "254782243131") //Filter voice packets whose called party (B)is equal to "254782243131".

10) Filtering S1AP (Signalling between eNodeB & MME):   

(s1ap.ENB_UE_S1AP_ID == 101) //During LTE Attach & Default EPS Bearer Establishment, The eNodeB allocates 101 as the ENB-UE-S1AP-ID for the new session.
(s1ap.MME_UE_S1AP_ID == 211) //During LTE Attach & Default EPS Bearer Establishment, The MME allocates 211 as the MME-UE-S1AP-ID for the session.

11) Filtering GTP (GPRS Tunneling Protocol) packets:   

(gtp.ptmsi == 0xc6eb8017) //Filter GTP packets whose P-TMSI(Packet Temporary Mobile Subscriber Identity) is equal to "0xc6eb8017".












No comments: