Wireshark suggested filters

  • 1
  • Question
  • Updated 4 years ago
  • (Edited)
Hello,

I am trying to sniff the TPC/IP packet from/to Flex and PC and I am using Wireshark.
Can you suggest some kind of filters I should use to display only data packets used in the command protocol? I would like to get something like this:

from PC to Radio: request xxx
from radio to PC: answer yyy

Reading data packets in wireshark is like filling a glass of water in Niagara Falls :) HI

73' Enzo
iw7dmh
Photo of IW7DMH, Enzo

IW7DMH, Enzo

  • 353 Posts
  • 84 Reply Likes

Posted 4 years ago

  • 1
Photo of Jim - N7CXI

Jim - N7CXI

  • 124 Posts
  • 8 Reply Likes
Hi Enzo,
I don't know what ports SmartSDR uses, but you can build a WireShark filter to only show traffic to or from a specific IP address:

host 192.168.0.99

Replace the IP address in that example with the specific address of your radio, and that should help filter the traffic.

Best 73,
Jim N7CXI
Photo of IW7DMH, Enzo

IW7DMH, Enzo

  • 353 Posts
  • 84 Reply Likes
Hello Jim,

filtering using only IP address is not enought as traffic between PC and Flex is really very high.
For "Discovering protocol" you have to filter UDP packets on port 4992 and for "Command Protocol" you have to filter TCP/IP packets on port 4991.
Also with these additional filters I still get a lot of packets so a more specific filter would help me in following traffic.
I'm not very used to study protocols. This should be a children's game for some Ciscoman friends.

Thank you very much.
73' Enzo
iw7dmh
 
(Edited)
Photo of Jim - N7CXI

Jim - N7CXI

  • 124 Posts
  • 8 Reply Likes
If you're filtering everything except the Flex protocol packets, I'm not sure what else you can filter?
The 6000-series radios move a lot of data over the ethernet connection, so there will be a lot of packets.

73,
Jim N7CXI
Photo of IW7DMH, Enzo

IW7DMH, Enzo

  • 353 Posts
  • 84 Reply Likes
Yes, there will be again a lot of data.
What I am looking for is ignoring all PING packets and filtering packets by "data" content: for example only packets that contain a string like " |cw " and so on.
It seems Whireshark has a very complex filtering syntax. I have to search better.

73',
Enzo
(Edited)
Photo of IW7DMH, Enzo

IW7DMH, Enzo

  • 353 Posts
  • 84 Reply Likes
Here we are.
After some attempts I setted up two kind of filters: one for discovering protocol and one for command protocol. You have to type the following strings in Wireshark filter textbox

Discovering Protocol
====================
udp.port==4992 and ip.src==169.254.8.146




Command Protocol
================
tcp.port==4992 and ip.dst==169.254.8.146 and tcp.len>0 and data.data contains "cw".

I made an attempt to change the keyer speed from 18 wpm to 17 wpm.
here is the packet sent from PC to Flex


And here the answer from Flex to PC. It seems answer is send twice.



For other commands you can change your filter from "cw" to which one you want.

Hope this can help.

73' Enzo
iw7dmh