{"id":2095,"date":"2012-06-16T16:32:41","date_gmt":"2012-06-16T15:32:41","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=2095"},"modified":"2015-03-06T18:27:40","modified_gmt":"2015-03-06T18:27:40","slug":"useful-riverbed-steelhead-wireshark-filters","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=2095","title":{"rendered":"Useful Riverbed SteelHead Wireshark Filters"},"content":{"rendered":"
\n

Useful Wireshark filters<\/strong><\/p>\n

To Find Inner channel splice setup: rvbd.sport.setup.type eq 0x1<\/code><\/p>\n

Using Riverbed Wireshark 1.8.2 you can use a new feature to find all inner channel traffic for a conversation. You can for instance use the Inner channel splice setup filter rvbd.sport.setup.type eq 0x1 <\/code>to display all splice setups or some other method.<\/p>\n

When you have identified the splice connection you are interested in you can then right click on the connection in Wireshark and choose the ‘Find the inner channel’ option to try to locate the entire inner channel connection. You can also right click on any part of an optimised connection to obtain the same result.<\/p>\n

<\/p>\n

Other filters<\/strong><\/p>\n

Checking for Oplock(Server): smb.cmd = 0xa2 or smb.cmd =<\/code> 0x24<\/tt><\/p>\n

Filter based on 2 IP address (bothways) and 2 ports: (ip.addr eq XXX.XXX.XXX.XXX and ip.addr eq XXX.XXX.XXX.XXX) and (tcp.port eq 3548 and tcp.port eq 80)<\/code><\/p>\n

Filter based on 2 IP address (bothways): ip.addr eq XXX.XXX.XXX.XXX and ip.addr eq XXX.XXX.XXX.XXX<\/code><\/p>\n

IP Source: ip.src == XXX.XXX.XXX.XXX<\/tt><\/p>\n

IP Destination: ip.dst == XXX.XXX.XXX.XXX<\/tt><\/p>\n

IP Source and Destination: ip.src = XXX.XXX.XXX.XXX and ip.dst =<\/code> XXX.XXX.XXX.XXX<\/tt><\/p>\n

IP Source or Destination: ip.src = XXX.XXX.XXX.XXX or ip.dst =<\/code> XXX.XXX.XXX.XXX<\/tt><\/p>\n

Packet loss: tcp.analysis.retransmission or tcp.analysis.fast_retransmission or tcp.analysis.lost_segment or tcp.analysis.duplicate_ack<\/code><\/p>\n

Slow SMB: smb.time >= 0.02<\/tt><\/p>\n

SMB signing: smb && smb.signature!=00:00:00:00:00:00:00:00<\/tt><\/p>\n

Destination ARP for IP address: arp.dst.proto_ipv4 == XXX.XXX.XXX.XXX<\/tt><\/p>\n

Source ARP for IP address: arp.src.proto_ipv4 == XXX.XXX.XXX.XXX<\/tt><\/p>\n

Destination ARP Source: arp.dst.hw_mac == XXX.XXX.XXX.XXX<\/tt><\/p>\n

Source ARP Source: arp.src.hw_mac == XXX.XXX.XXX.XXX<\/tt><\/p>\n

BGP Originator: bgp.originator_id == XXX.XXX.XXX.XXX<\/tt><\/p>\n

BGP Next Hop: bgp.next_hop == XXX.XXX.XXX.XXX<\/tt><\/p>\n

CDP<\/a> TTL: cdp.ttl<\/code><\/p>\n

CDP<\/a> TTL Length: cdp.tlv.len<\/code><\/p>\n

DNS Authenticated Answer: dns.flags.authenticated<\/code><\/p>\n

DNS Updates: dns.count.updates<\/code><\/p>\n

DNS Response: dns.response<\/code><\/p>\n

General use<\/p>\n

Filter on one type of IP address: ip.addr == XXX.XXX.XXX.XXX<\/tt><\/p>\n

Filter on two types of IP address: ip.addr eq XXX.XXX.XXX.XXX and ip.addr eq XXX.XXX.XXX.XXX<\/code><\/p>\n

Filter on 2 IP address and 2 different TCP port, 3548 and 80: (ip.addr eq XXX.XXX.XXX.XXX and ip.addr eq XXX.XXX.XXX.XXX) and (tcp.port eq 3548 and tcp.port eq 80)<\/code><\/p>\n

Non source-routed packets can be found with: tr.sr == 0<\/tt><\/p>\n

Ethernet addresses and byte arrays are represented by hex digits. The hex digits may be separated by colons, periods, or hyphens:<\/p>\n

eth.dst eq ff:ff:ff:ff:ff:ff<\/tt><\/p>\n

aim.data == 0.1.0.d<\/tt><\/p>\n

fddi.src == aa-aa-aa-aa-aa-aa<\/tt><\/p>\n

echo.data == 7a<\/tt><\/p>\n

IPv4 addresses can be represented in either dotted decimal notation or by using the hostname:<\/p>\n

ip.dst eq www.mit.edu<\/tt><\/p>\n

ip.src == 192.168.1.1<\/tt><\/p>\n

Autodiscovery and probe filters.<\/p>\n

Finding all probes and probe responses Filter: tcp.options.rvbd.probe<\/code>
\nFinding probes by CFE Filter: tcp.options.rvbd.probe.prober == XXX.XXX.XXX.XXX<\/code><\/code>
\nFinding probe responses by SFE Filter: tcp.options.rvbd.probe.proxy.ip == XXX.XXX.XXX.XXX<\/code><\/code><\/p>\n

SYN+<\/p>\n

tcp.options contains 4c:a<\/code><\/p>\n

SYN-ACK+<\/p>\n

tcp.options contains 4c:e<\/code><\/p>\n

Extra probe response present (required for transparency)<\/p>\n

tcp.options contains 4c:4:e<\/code><\/p>\n

Transparency enabled in SYN-ACK+<\/p>\n

(this needs thorough testing) tcp.options[-6:3] eq 4c:4:e and tcp.options[-3] & c<\/code><\/p>\n<\/div>\n

<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Useful Wireshark filters To Find Inner channel splice setup: rvbd.sport.setup.type eq 0x1 Using Riverbed Wireshark 1.8.2 you can use a new feature to find all inner channel traffic for a conversation. You can for instance use the Inner channel splice setup filter rvbd.sport.setup.type eq 0x1 to display all splice setups or some other method. When […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[27],"tags":[75,47,37],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2095"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2095"}],"version-history":[{"count":3,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2095\/revisions"}],"predecessor-version":[{"id":2166,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2095\/revisions\/2166"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2095"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}