Quick Check - Common WireShark Filters When Troubleshooting Network/Communication Problems

Here is a list of commonly used WireShark filters for network and systems engineers when analyzing packet dumps:

1) Filtering DNS packets according to their "return code" (rcode):

(dns.flags.rcode == x) //Filter dns packets whose rcode is equal to "x".

!(dns.flags.rcode == x) //Filter dns packets whose rcode is NOT equal to "x".

See common "return codes" and their description in the table below:

Return Message	RCODE	Description
NOERROR	0	DNS Query completed successfully
FORMERR	1	DNS Query Format Error
SERVFAIL	2	Server failed to complete the DNS request
NXDOMAIN	3	Domain name does not exist.
NOTIMP	4	Function not implemented
REFUSED	5	The server refused to answer for the query
YXDOMAIN	6	Name that should not exist, does exist
XRRSET	7	RRset that should not exist, does exist
NOTAUTH	8	Server not authoritative for the zone
NOTZONE	9	Name not in zone

2) Filtering packets based on Source and Destination IP Addresses:

(ip.src == 31.13.64.11) && (ip.dst == 10.210.0.10)

3) Filtering M3UA packets based on Origination Point Code (OPC): 

(m3ua.protocol_data_opc == 12345) //Filter M3UA packets whose OPC is equal to "12345".

4) Filtering M3UA packets based on Destination Point Code (DPC): 

(m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose DPC is equal to "34567".

5) Filtering M3UA packets based on OPC or DPC: 

(m3ua.protocol_data_opc == 12345) || (m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose OPC is equal to "12345" OR DPC is equal to "34567".

(m3ua.protocol_data_opc == 12345) && (m3ua.protocol_data_dpc == 34567) //Filter M3UA packets whose OPC is equal to "12345" AND DPC is equal to "34567".

6) Filtering GSM MAP packets based on TBCD (Telephony Binary-Coded Decimal) digits: 

(gsm_map.tbcd_digits == "1234567") //Filter GSM MAP packets whose TBCD is equal to "1234567".

7) Filtering TCP/UDP packets based on port number: 

(tcp.port == 8080) //Filter TCP packets whose source or destination port number is equal to "8080".

(tcp.srcport == 80) //Filter TCP packets whose source port number is equal to "80".

(tcp.dstport == 443) //Filter TCP packets whose source or destination port number is equal to "443".

(udp.port == 53) //Filter UDP packets whose source or destination port number is equal to "53".

(udp.srcport == 53) //Filter UDP packets whose source port number is equal to "53".

(udp.dstport == 53) //Filter UDP packets whose destination port number is equal to "53".

8) Filtering TCAP (Transaction Capabilities Application Part) packets based on OTID (Orig. Transaction Id)/DTID (Dest. Transaction Id): 

(tcap.otid == 1a:00:6a:15) //Filter TCAP packets whose otid is equal to "1a:00:6a:15".

(tcap.dtid == 1a:00:6a:15) //Filter TCAP packets whose dtid is equal to "1a:00:6a:15".

9) Filtering Voice packets based on E.164 international telephone numbering plan:   

(e164.calling_party_number.digits == "256723039294") //Filter voice packets whose calling party (A)is equal to "256723039294".

(e164.called_party_number.digits == "254782243131") //Filter voice packets whose called party (B)is equal to "254782243131".

10) Filtering S1AP (Signalling between eNodeB & MME):   

(s1ap.ENB_UE_S1AP_ID == 101) //During LTE Attach & Default EPS Bearer Establishment, The eNodeB allocates 101 as the ENB-UE-S1AP-ID for the new session.

(s1ap.MME_UE_S1AP_ID == 211) //During LTE Attach & Default EPS Bearer Establishment, The MME allocates 211 as the MME-UE-S1AP-ID for the session.

11) Filtering GTP (GPRS Tunneling Protocol) packets:   

(gtp.ptmsi == 0xc6eb8017) //Filter GTP packets whose P-TMSI(Packet Temporary Mobile Subscriber Identity) is equal to "0xc6eb8017".

Taking a TCPDUMP on Linux OS and Writing the packets to CAP file (Wireshark Readable)

Summary: 

In this post, we are going to quickly take a TCP Dump (Capture packets) on a linux server and write the output to a CAP file that is WireShark readable. 

Problem or Goal: 

Used to capture and analyze packets when troubleshooting network/communication problems. 

Cause: 

N/A

Solution (Examples): 

a) TCP Dump on a single physical interface to capture DNS (port 53) packets

#tcpdump -i eth0 -s 2000 -w /tmp/name_of_trace_file.cap port 53

b) TCP Dump on a bonded interface to capture HTTP (port 80) packets

#tcpdump -i bond1 -s 2000 -w /tmp/name_of_trace_file.cap port 80

Note: "-s 2000" limits the packet length to 2000bytes, default packet length is 1024bytes use "-s 0" to remove the packet length limit. 

Problem Solved?

You can then transfer the file by SFTP to your laptop and read it with Wireshark 

How to capture tcp dump on juniper srx 5800 and analyze file using wireshark

Summary: 

How to take a tcp dump on Juniper SRX 5800. This tcp dump is of file type .pcap and can be analyzed using third party tools like wireshark.

Problem or Goal:

To analyze traffic traversing the firewall using wireshark

Cause:

For troubleshooting purposes

Solution:

Reference: How to create a PCAP packet capture on high-end SRX devices

Example:

Edit the config as below:

#set security datapath-debug capture-file my-capture
#set security datapath-debug capture-file format pcap
#set security datapath-debug capture-file size 1m
#set security datapath-debug capture-file files 5
#set security datapath-debug maximum-capture-size 1500
#set security datapath-debug action-profile do-capture event np-egress packet-dump
#set security datapath-debug action-profile do-capture event np-ingress packet-dump
#set security datapath-debug packet-filter my-filter action-profile do-capture
#set security datapath-debug packet-filter my-filter destination-prefix x.x.x.x/x
#commit 

To start the debug:

>request security datapath-debug capture start

To stop the debug:

>request security datapath-debug capture stop

You can use this command to show the captured packets, but the output doesn't make sense, you will have to export the file into third party tools like wireshark:

>show security datapath-debug capture

Before you pick the file to analyze it with wireshark, run this command:

>start shell user root
Password :
root% pwd
If you are not in /var/log;


root@% cd /var/log
root@% e2einfo -Ccapture -Snormalize -I my-capture -F my-capture.pcap
sucessfully convert 124 packets

root@% ls -ltr




You can use tools like WinSCP to copy the file from the SRX device to your computer.




When troubleshooting is finished, remove all datapath-debug configuration, including the datapath-debug configuration for packet capturing (packet-dump) which needs to be started/stopped manually. If any part of the debugging configuration remains active, it will continue using the resources of the device (CPU/memory).




#delete security datapath-debug

#commit




Problem Solved?

Yes.

TCP Dump - WireShark Capture/Snoop on a Unix/Linux interface - Free Script

Here is a free tool to capture live packets on a Unix/Linux interface and analyze the captured packets using WireShark.

Simple Procedure:
1. Download the tcpdump tool here
2. Unzip the file
3. Transfer the file to the server whose interface you want to snoop
4. You might want to change the file permissions to make it executable (command: #chmod 777 file_name)
5. Identify the interface name that you want to snoop (command: #ifconfig -a)
6. Run the script: ./tcpdump -i eth88 -s 0 -w filename.cap
     where:

• -i eth88 refers to the specified listening network interface.
• -s 0 indicates that the message length is not limited. By default, 1,024 bytes is captured from each packet.
• -w filename.cap directly writes the packet into the file without analysis or printout. replace filename with the actual name of the file.