Bearbeiten von „WireShark“

= Installation =
* fedora (alt): wireshark-gnome (wegen GUI)

= Filter Beispiele =

* Empfänger oder Sender: ip.addr ==  1.2.3.4
* ip.src==10.0.0.5
* ! (ip.addr = 1.2.3.4)
* Substring: eth.src[:4] == 00:00:83:00
* String: http.request.uri == "https://www.wireshark.org/"
* Verknüpfung von Bedingungen: ip.src==10.0.0.5 and tcp.flags.fin

== Felder:
* ip (IPv4): addr, dst, flags, host (Src || Dest), len, proto, src, tos (type of service)
* tcp: dstport, flags, flags.fin, flags.syn, hdr_len, len (segment len), port, seq, srcport, 
* eth Ethernet): addr, dst, len, src