# Wireshark Capturing & Filtering Data Packets

###### tags: `ntop` `nProbe Cento` `OS` `Linux` `nDPI`

Environment:
SCB 1921
Linux 20.04 & Windows 10

### Features:

Wireshark contains several useful features, the foremost of which are listed below:
1. Inspecting thousands of protocols
2. New protocols being added with every update
3. Live-capturing of protocols with offline analysis
4. Three-way handshake
5. Maximum portability: runs on Solaris, Linux, Windows, MAC OS X, FreeBSD, and more
6. Analyzing VoIP protocols
7. Reads data from many platforms, i.e., Wi-Fi, Ethernet, HDLC, ATM, USB, Bluetooth, Frame Relay, Token Ring, and more
8. Results can be saved in CSV, XML, PostScript, and plain text documents
9. Reads and write a wide variety of captured file formats

### Installation of Wireshark on Ubunut Linux.

# sudo apt update
# sudo apt upgrade
# sudo apt install wireshark

#### Enable Root Privileges
When Wireshark installs on your system, you will be prompted by the following window. As Wireshark requires superuser/root privileges to operate, this option asks to enable or disable permissions for all every user on the system. Press the “Yes” button to allow other users, or press the “No” button to restrict other users from using Wireshark.

# sudo usermod -aG wireshark <username>
# wireshark

#### **The Highlighted Interface is active and coming the packets.**


#### **Double-Click on that Interfrace where you want to capature the packets. When you double click the wireshark start capturing the packets.**


### Menu Button


### Add the filter if you want to filter out the packets infuture


#### If you want to enable or disable protocols.

#### Filter out the protocols (You can apply filters to sort out or see the specific protocols)


#### Filter Operators
https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html


#### e.g. I want to filter out a specific protocol (ip.src== 192.168.110.41 or arp). you want add more parameter as per your requirements.


#### Now Mark all the protocols

### Save a pcap file
#### Export the selected packets
#### Write the filename and select the extension of the file e.g. pcap

Reference.
https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/