wireshark & fiddler

wireshark display filter
https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html

wireshark can't capture loopback
https://wiki.wireshark.org/CaptureSetup/Loopback
If you are trying to capture traffic from a machine to itself, that traffic will not be sent over a real network interface,
even if it's being sent to an address on one of the machine's network adapters.

Logical Operations
&& and
|| or

potocols
ip arp
tcp udp
http ssl
icmp smtp
ftp dns

address & port
ip.dst
ip.src eq 10.6.22.25
ip.addr == 10.5.29.48
tcp and tcp.port eq 80
tcp.port in {443 4430...4433}

MAC
eth.addr == A0:00:00:00:C3:77

content & slice
tcp[8:3]==20:21:22
http contains 「GET」

HTTP
http.request.method == 「GET」
http.request.uri == 「/img/logo-edu.gif」
// response
http contains 「HTTP/1.1 200 OK」 && http contains 「Content-Type: 「

capture filter
<Protocol> <Direction> <Host(s)> < Value> < Logical Operations> <Other expression>
Host: host ip, port 80, portrange 1-30
tcp port 23 and host 10.0.0.5
tcp src port 80 or tcp dst port 880 and host 10.3.4.4
ip port 33

 

Fiddler filter
used to capture http traffic
http://docs.telerik.com/fiddler/KnowledgeBase/Filters
once fiddler starts, it will change the default system proxy to itself.
we should set the gateway for it when network needs a proxy to get access to internet