wireshark display filter
https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
wireshark can't capture loopback
https://wiki.wireshark.org/CaptureSetup/Loopback
If you are trying to capture traffic from a machine to itself, that traffic will not be sent over a real network interface,
even if it's being sent to an address on one of the machine's network adapters.
Logical Operations
&& and
|| or
potocols
ip arp
tcp udp
http ssl
icmp smtp
ftp dns
address & port
ip.dst
ip.src eq 10.6.22.25
ip.addr == 10.5.29.48
tcp and tcp.port eq 80
tcp.port in {443 4430...4433}
MAC
eth.addr == A0:00:00:00:C3:77
content & slice
tcp[8:3]==20:21:22
http contains “GET”
HTTP
http.request.method == “GET”
http.request.uri == “/img/logo-edu.gif”
// response
http contains “HTTP/1.1 200 OK” && http contains “Content-Type: “
capture filter
<Protocol> <Direction> <Host(s)> < Value> < Logical Operations> <Other expression>
Host: host ip, port 80, portrange 1-30
tcp port 23 and host 10.0.0.5
tcp src port 80 or tcp dst port 880 and host 10.3.4.4
ip port 33
Fiddler filter
used to capture http traffic
http://docs.telerik.com/fiddler/KnowledgeBase/Filters
once fiddler starts, it will change the default system proxy to itself.
we should set the gateway for it when network needs a proxy to get access to internet