Wireshark filter all current packets?

1
votes

Let's say I want to monitor [A] application and it's not running yet
When I start Wireshark it will show me everything happening in my network adapter so then I filter these packets like this

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((!(ip.addr == 192.168.2.3) && !(smb2)) && !(ip.addr == 192.168.2.1)) && .....

you can see from the number of parentheses how long my filter is
after that I see a clean view with almost no packets
now I run [A] application and I will see almost only [A] traffic in the view

is there a shorter way to achieve this without making all of these filters manually?
like add "everything" in the current view to the filter then I start [A] to monitor it alone

1
networkingwiresharknetwork-traffic
What traffic do you actually want to capture? For example, does your application communicate over a specific port? Or to a specific host? If you can provide a bit more detail about your application in this regard, then it's more likely that someone will be able to suggest a more optimal filter than what you're using now. And if you truly require a complicated filter, then there are other possible ways to reduce it too, but before I offer suggestions, I'd like to better understand what exactly you're trying to capture. - Christopher Maynard
@ChristopherMaynard I want to analyze a new application and check what it does, which protocols does it use, which server does it communicates with. so I have no background about it to be more specific about what I want to filter, the only way is to filter all the things currently running then when I have a clean view, I start the application to monitor it's traffic alone. - alinoob
If you're on the Windows platform, then it might be easier for you to use another tool besides Wireshark. I believe Microsoft's [Message Analyzer][1] and/or [Network Monitor][2] tools allow you to filter by Process ID. Start capturing before launching the application, then find the Process ID from Task Manager's details. Wireshark may support this too one day, but not yet (see Bug 1184[3]). [1]: microsoft.com/en-us/download/details.aspx?id=44226 [2]: microsoft.com/en-us/download/details.aspx?id=4865 [3]: bugs.wireshark.org/bugzilla/show_bug.cgi?id=1184 - Christopher Maynard

1 Answers

-1
votes

You can go to the Packet-details pane and right-click on some value/s you wish to filter by and use Wireshark's built in "Prepare a Filter"/"Apply as Filter" to build a filter.

I'd suggest using more White list filtering (e.g. "protocol == XXX") instead of Black listing (e.g. "!(protocol == YYY) && !(protocol == ZZZ)" etc.).