Bearbeiten von „WireShark“

= Installation =
* fedora (alt): wireshark-gnome (wegen GUI)

= Filter Beispiele =

* Empfänger oder Sender: ip.addr ==  1.2.3.4
* ip.src==10.0.0.5
* ! (ip.addr = 1.2.3.4)
* Substring: eth.src[:4] == 00:00:83:00
* String: http.request.uri == "https://www.wireshark.org/"

== Verknüpfung von Bedingungen: ==
* or ||
* and: &&
** ip.src==10.0.0.5 and tcp.flags.fin
* xor: ^^ 

== Felder: ==
* ip (IPv4):
** addr
** dst
** flags
**  host (Src || Dest)
** len
** proto
** src, tos (type of service)
* tcp (Transmission Control Protocol):
** dstport
** flags, flags.fin, flags.syn
** hdr_len
** len (segment len)
** port
** seq
** srcport, 
* eth (Ethernet):
** addr
** dst
** len
** src
* http (HTTP Hyper Text Transmission Protocol)
** connection
** content_length
** content_type
** cookie, cookie_pait
** host
** referer
** request, request.method, request.uri
** response, response.code (status code)
** server