Wireshark Analyser
This page runs Tshark with a given Pcap file and a defined filter. First select your Wireshark trace:
Trace name: /log/hydra_telnet.zip
Tshark Output
Click here for the Pcap file. The Tshark output is:
c:\program files\wireshark\tshark.exe -Y "telnet contains \"Failed\"" -r hydra_telnet.pcap 385 4.659831 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 386 4.660059 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 389 4.688194 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 390 4.688891 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 626 9.828384 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 630 9.843781 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 631 9.844912 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 632 9.845151 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 701 15.031033 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 708 15.062862 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... 711 15.065358 192.168.47.200 → 192.168.47.171 TELNET 132 Telnet Data ... |
Rules file
telnet contains \"Failed\"
Examples
The following uses the Wireshark display filter:
- PNG Filter: http contains "\x89\x50\x4E\x47". Trace with a PNG and PNG filter: Test. Pcap
- PDF Filter: http contains "%PDF". Trace with a PDF and PDF filter: Test. Pcap
- GIF Filter: http contains "GIF89a". Trace with a GIF and GIF filter: Test. Pcap
- ZIP Filter: http contains "\x50\x4B\x03\x04". Trace with a ZIP and ZIP filter: Test. Pcap
- JPEG Filter: http contains "\xff\xd8". Trace with a JPEG and JPEG filter: Test. Pcap
- MP3 Filter: http contains "\x49\x44\x33". Trace with an MP3 and MP3 filter: Test. Pcap
- RAR Filter: http contains "\x52\x61\x72\x21\x1A\x07\x00". Trace with a RAR and RAR filter: Test. Pcap
- AVI Filter: http contains "\x52\x49\x46\x46". Trace with a AVI and AVI filter: Test. Pcap
- SWF Filter: http contains "\x46\x57\x53". Trace with a SWF and SWF filter: Test. Pcap
- GZip Filter: http contains "\x1F\x8B\x08". Trace with a GZIP and GZIP filter: Test. Pcap
- Email address Filter: smtp matches ""[a-zA-Z0-9._%+-]+@[a-zA-Z0-9._%+-]"". Trace with an email and Email regex filter: Test. Pcap
- IP address Filter: http matches ""[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}.[0-9]{1,3}"". Trace with HTTP traffic and IP address regex filter: Test. Pcap
- Credit card details (Mastercard) Filter: smtp matches ""5\\d{3}(\\s|-)?\\d{4}(\\s|-)?\\d{4}(\\s|-)?\\d{4}"". Trace with an email and Mastercard regex filter: Test. Pcap
- Credit card details (Visa) Filter: smtp matches ""4\\d{3}(\\s|-)?\\d{4}(\\s|-)?\\d{4}(\\s|-)?\\d{4}"". Trace with an email and Visa filter regex filter: Test. Pcap
- Credit card details (Am Ex) Filter: smtp matches ""3\\d{3}(\\s|-)?\\d{6}(\\s|-)?\\d{5}"". Trace with an email and Am Ex regex filter: Test. Pcap
- Domain name Filter: http matches ""[a-zA-Z0-9\-\.]+\.(com|org|net|mil|edu|COM|ORG|NET|MIL|EDU|UK)"". Trace with an email and Email regex filter: Test. Pcap
- FTP User/Password Crack Filter: ftp contains \"530 User\". Trace with FTP Hydra and 530 filter: Test. Pcap
- FTP Login Filter: tcp.port==21 && tcp.flags.syn==1 && tcp.flags.ack==1. Trace with FTP Hydra and SYN/Port 21 filter: Test. Pcap
- Telnet Login Filter: tcp.port==23 && tcp.flags.syn==0 && tcp.flags.ack==0. Trace with Telnet Hydra and SYN/Port 23 filter: Test. Pcap
- Telnet Login Filter: telnet contains "login": Test. Pcap
- Telnet Login Filter: telnet contains "Failed": Test. Pcap
- Hping DoS Filter: tcp.flags.syn==1 && tcp.flags.ack==0. Trace with Hping and SYN flag filter: Test. Pcap