Shark SE400 User's Guide download pdf (Page 138)

Working with captured packets

129

about the Add Expression dialog in Section 6.5, “The “Filter Expression”

dialog box”

OK Display Filter only: This button applies the selected filter to the current

display and closes the dialog.

Apply Display Filter only: This button applies the selected filter to the current

display, and keeps the dialog open.

Save Save the current settings in this dialog. The file location and format is

explained in Appendix B, Files and Folders.

Close Close this dialog. This will discard unsaved settings.

6.7. Defining and saving filter macros

You can define filter macros with Wireshark and give them labels for later use. This can save time in

remembering and retyping some of the more complex filters you use.

6.8. Finding packets

You can easily find packets once you have captured some packets or have read in a previously saved

capture file. Simply select the Find Packet… menu item from the Edit menu. Wireshark will pop up

the dialog box shown in Figure 6.9, “The “Find Packet” dialog box”.

6.8.1. The “Find Packet” dialog box

Figure 6.9. The “Find Packet” dialog box

You might first select the kind of thing to search for:

• Display filter

Simply enter a display filter string into the Filter: field, select a direction, and click on OK.

For example, to find the three way handshake for a connection from host 192.168.0.1, use the

following filter string:

1 2 ... 133 134 135 136 137 138 139 140 141 142 143 ... 227 228

No comments

Shark SE400 User's Guide Page 138