我整理的Wireshark实战技巧，网络问题秒解决！

ip.src == 192.168.1.100      # 源IP
ip.dst == 192.168.1.1        # 目标IP  
ip.addr == 192.168.1.0/24    # IP段
!(ip.addr == 192.168.1.1)    # 排除IP

tcp.port == 80               # HTTP流量
tcp.port == 443              # HTTPS流量
tcp.port == 22               # SSH流量
tcp.port >= 1000 and tcp.port <= 2000  # 端口范围

http.request.method == "POST"         # POST请求
http.response.code == 404             # 404错误
http.host == "www.example.com"        # 特定域名
http.user_agent contains "Chrome"     # 浏览器类型
http.time > 1.0                       # 响应时间超过1秒

# 逻辑组合
(tcp.port == 80 or tcp.port == 443) and ip.src == 192.168.1.100

# 内容搜索
tcp contains "password"               # 包含密码字段
http contains "admin"                 # 包含admin关键词

# 正则表达式
http.host matches ".*\\.com$"         # 匹配.com域名

# 时间过滤
frame.time >= "2024-01-01 00:00:00"   # 特定时间范围

host 192.168.1.1              # 特定主机
port 80                        # 特定端口  
host 192.168.1.1 and port 80  # 组合条件
not port 22                    # 排除SSH

tcp.analysis.retransmission    # TCP重传
tcp.analysis.duplicate_ack     # 重复ACK
tcp.analysis.zero_window       # 窗口为零
tcp.analysis.out_of_order      # 包乱序

# 错误响应分析
http.response.code >= 400      # 客户端和服务器错误

# 性能分析  
http.time > 2.0                # 慢速响应
http.content_length > 1000000  # 大文件传输

# 安全分析
http.request.uri contains "union"    # SQL注入尝试
http.request.uri contains "<script>" # XSS攻击尝试

dns.flags.response == 0        # DNS查询
dns.flags.response == 1        # DNS响应
dns.flags.rcode != 0           # DNS错误
dns.time > 0.1                 # 慢速DNS查询
dns.qry.name contains "example.com"  # 特定域名

tls.handshake                  # TLS握手过程
tls.handshake.certificate      # 证书信息
tls.alert                      # TLS警报
tls.record.version == 0x0303   # TLS 1.2版本

tcp.flags.syn == 1 and tcp.flags.ack == 0  # SYN扫描

# SQL注入尝试
http.request.uri contains "union" or http.request.uri contains "select" or http.request.uri contains "drop"

# XSS攻击尝试  
http.request.uri contains "<script>" or http.request.uri contains "javascript:"

# 目录遍历攻击
http.request.uri contains "../"

# 异常用户代理
http.user_agent contains "bot" or http.user_agent contains "scanner"

# 大量失败请求
http.response.code == 401 or http.response.code == 403

# DNS隧道检测
dns.qry.name.len > 50

# 明文密码传输
tcp contains "password=" or tcp contains "passwd="

# 敏感信息泄露
tcp contains "credit" or tcp contains "ssn"

# 可疑文件传输
http.request.method == "PUT" or ftp-data

http contains "github"
http.host contains "github"
http.request.uri contains "github"

# 实时抓包
tshark -i eth0

# 分析文件
tshark -r capture.pcap

# 应用过滤器
tshark -r capture.pcap -Y "http"

# 自定义输出
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e http.host

# JSON 输出
tshark -r capture.pcap -T json

# 导出 HTTP 对象
tshark -r capture.pcap --export-objects http,/tmp/objects/

# 统计分析
tshark -r capture.pcap -z conv,tcp
tshark -r capture.pcap -z endpoints,ip
tshark -r capture.pcap -z io,phs

#!/bin/bash
# HTTP 流量分析脚本

echo"=== 访问最多的网站 ==="
tshark -r $1 -Y "http.request" -T fields -e http.host | \
sort | uniq -c | sort -nr | head -10

echo"=== HTTP 状态码分布 ==="
tshark -r $1 -Y "http.response" -T fields -e http.response.code | \
sort | uniq -c | sort -nr

echo"=== 用户代理统计 ==="
tshark -r $1 -Y "http.request" -T fields -e http.user_agent | \
sort | uniq -c | sort -nr | head -5