> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/ctf/forensic/pcap-analysis-wireshark.md).

# PCAP Analysis - Wireshark

```
# Filters
ip.addr == <IP Address>
ip.src == <SRC IP Address> and ip.dst == <DST IP Address>
tcp.port eq <Port #> or <Protocol Name>
udp.port eq <Port #> or <Protocol Name>
# arp opcode: Request (1) Reply (2)
# Ex: reply
arp and arp.opcode eq 2 

# Operators
    and - operator: and / &&
    or - operator: or / ||
    equals - operator: eq / ==
    not equal - operator: ne / !=
    greater than - operator: gt /  >
    less than - operator: lt / <
```

{% embed url="<https://dfirmadness.com/case-001-pcap-analysis/>" %}