How to Use Wireshark to Search for a String in Packets – Linux Hint

On this article, you’ll learn to seek for strings in packets utilizing Wireshark. There are a number of choices related to string searches. Earlier than going additional on this article, it is best to have a common information of Wireshark Fundamental.

Assumptions

A Wireshark seize be in a single state; both saved/stopped or stay. We will carry out string search in stay seize additionally however for higher and clear understanding we are going to use saved seize to do that.

Step 1: Open Saved Seize

First, open a saved seize in Wireshark. It should appear like this:

Step 2: Open Search Choice

Now, we want a search possibility. There two methods to open that possibility:

1. Use the keyboard shortcut “Ctrl+F”
2. Click on “Discover a packet” both from the surface icon or go to “Edit->Discover Packet”

Take a look at the screenshots to view the second possibility.

Whichever possibility you employ, the ultimate Wireshark window will appear like the screenshot under:

Step 3: Label Choices

We will see a number of choices (dropdowns, checkbox) contained in the search window. You’ll be able to label these choices with numbers for simple understanding. Observe the screenshot under for numbering:

Label1
There are three sections within the dropdown.

1. Packet listing
2. Packet particulars
3. Packet bytes

From the under screenshot, you may see the place these three sections in Wireshark are positioned:

Deciding on part a/b/c implies that the string will probably be executed in that part solely.

Label2
We’ll maintain this selection because the default, as it’s the greatest for frequent looking out. It is suggested to maintain this selection because the default except it’s required to vary it.

Label3
By default, this selection is unchecked. If “Case delicate” is checked, then the string search will solely discover actual matches of the searched string. For instance, for those who seek for “Linuxhint” and Label3 is checked, then this won’t seek for “LINUXHINT” in Wireshark seize.

It is suggested to maintain this selection unchecked except it’s required to vary it.

Label4
This label has various kinds of searches, comparable to “Show filter,” “Hex worth,” “String,” and “Common Expression.” For the needs of this text, we are going to choose “String” from this dropdown menu.

Label5
Right here, we have to enter the search string. That is the enter for the search.

Label6
After the Label5 enter is given, click on the “Discover” button to set off the search.

Label7
In the event you click on “Cancel,” then the search home windows will shut, and that you must return to observe Step 2 to get this search window again.

Step 4: Examples

Now that you simply understood the choices for looking out, allow us to check out some examples. Observe that we have now disabled the coloring rule to see the search packet we chosen extra clearly.

Try1 [Options combination used: “Packet List” + “Narrow & Wide” + “Unchecked Case Sensitive”+ String]

Search String: “Len=10”

Now, click on “Discover.” Beneath is the screenshot for the primary click on on “Discover:”

As we have now chosen “Packet listing,” the search was carried out contained in the packet listing.

Subsequent, we are going to click on the “Discover” button once more to see the following match. This may be seen within the screenshot under. We didn’t mark any sections to can help you perceive how this search occurs.

With the identical mixture, allow us to search the string: “Linuxhint” [To check not found scenario].

On this case, you may see the yellow-colored message on the left-bottom aspect of Wireshark, and no packet is chosen.

Try2 [Options combination used: “Packet details” + “Narrow & Wide” + “Unchecked Case Sensitive”+ String]

Search String: “Sequence quantity”

Now, we are going to click on “Discover.” Beneath is the screenshot for the primary click on on “Discover:”

Right here, the string discovered inside “packet particulars” was chosen.

We’ll examine the “Case delicate” possibility and use the search string as a “Sequence Quantity,” holding the opposite combos as is. This time, the string will match the precise “Sequence Quantity.”

Try3 [Options combination used: “Packet bytes” + “Narrow & Wide” + “Unchecked Case Sensitive”+ String]

Search String: “Sequence quantity”

Now, click on “Discover.” Beneath is the screenshot for the primary click on on “Discover:”

As anticipated, the string search is occurring contained in the packet bytes.

Conclusion

Performing a string search is a really helpful technique that can be utilized to discover a required string inside a Wireshark packet listing, packet particulars, or packet bytes. Good looking out makes evaluation of huge Wireshark seize information simple.