Wireshark Capture Filter for SSH

When analyzing network traffic, it's essential to use effective capture filters to streamline your workflow and extract relevant data from the captured packets. In this article, we'll explore how to use Wireshark's capture filter to collect information about hosts sending traffic to a test workstation on TCP port 22.

Running Multiple SSH Sessions

To perform captures and execute curl commands simultaneously, you should run two separate SSH sessions. This will enable you to work on the lab while monitoring the network traffic in real-time.

Capturing Traffic with tshark

In one of your SSH sessions, use the following command to capture traffic:

`tshark -f 'tcp src port 22' -Tfields -e ip.dst`

This command applies a capture filter that prints the IP address(es) of hosts sending traffic to the test workstation on TCP port 22. The output will be stored in `/root/ssh_ip` in a newline-delimited format.

Capturing HTTP Traffic

In another SSH session, run the following commands to capture and analyze HTTP traffic:

1. `curl`

2. `tshark -Y http -Tfields -e > http_response`

The first command initiates a curl request, while the second command captures HTTP traffic using Wireshark's display filter. The captured output will be stored in `/root/http_response`.

Capturing TCP Traffic on Port 80

To collect TCP traffic on port 80, use the following commands:

1. `curl` (in a separate SSH session)

2. `tshark -f 'tcp port 80' -V -R http > http_out`

These commands will capture and analyze HTTP traffic on port 80, storing the output in `/root/http_out`.

Learning Objectives

By completing this lab, you'll have achieved several learning objectives:

1. Use a `tshark` capture filter to collect TCP traffic on port 22

2. Use a `tshark` capture filter to collect TCP traffic on port 80

3. Use a `tshark` display filter to collect and print HTTP response codes

By mastering these Wireshark capture filters, you'll be better equipped to analyze network traffic and troubleshoot issues in your network infrastructure.

Wireshark capture filter for ssh