Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

2. Wireshark Quick Tips Filters Capture & Display Part 2 copy right 2008 www.gearbit.com [email_address]

5. Capture Filters: How to Organize copy right 2008 www.gearbit.com [email_address]

6. Capture Filters: Where to find the cfilter file copy right 2008 www.gearbit.com [email_address]

7. Capture Filters: copy right 2008 www.gearbit.com [email_address]

9. Capture Filters: Filter Strings You can tell WireShark to look for anything specific with the Filter String commands. The first position starts with 0 (zero) Example: Tcp[0:2]==80 8 0

10. Capture Filters: Filter Strings Filter Strings using Wireshark Capture Filters TCP Source Port tcp[0:2]==80 TCP Destination Port tcp[2:2]==80

11. Capture Filters: Filter Strings Here the same example shown in WireShark Example: Tcp[0:2]==80

12. Capture Filters

13. Capture Filters: Filter Strings Filter Strings showing a Capture Filter TCP port 21 in position 0 (zero) and look at 2 bytes Or ( || ) TCP port 21 in position 2 at 2 bytes