filtering by domain

networking filter wireshark pcap tshark

35,051

Assuming it's http web traffic, try http.host contains ".com"

Better yet, try http.host matches "\.com$"

Neither one will require DNS resolution since they search on the web host.

From http://wiki.wireshark.org/DisplayFilters

The matches operator makes it possible to search for text in string fields 
and byte sequences using a regular expression, using Perl regular expression 
syntax. Note: Wireshark needs to be built with libpcre in order to be able to 
use the matches operator.

35,051

Eray Balkanli

• Proven skills with 5 years of experience in Net/C# and MS SQL, and 2 years of experience in SharePoint, Microsoft Reporting Services (SSRS) and SQL Server Integration Services (SSIS) • Result oriented software developer with excellent track record of successful completion of projects, project milestones, and quality standards • Highly self-motivated, able to work with minimal supervision, and able to exercise good judgment to keep critical systems operational • Versatile team player with the ability to communicate at all levels of software development life cycle • Able to incorporate user needs into cost-effective, secure and user-friendly solutions • Very ambitious to research, learn and adapt to recent IT technologies • Demonstrated ability to public relations • Professional communication skills include fluency in English and Turkish

Updated on February 26, 2020

Comments

Eray Balkanli about 4 years

I want to filter my pcap file by their domains. I mean, I want to see the packets comes on a website ends with ".com", ".org" or ".net".

I tried: dns contains "com", ip.src_host == com, ip.src_host == com, http contains "com". None of them worked correctly.
- Thaddeus Albers about 10 years
  
  Are these saved capture files your are trying to filter or running capture files? from wireshark.org/docs/wsug_html_chunked/… The resolved names are not stored in the capture file or somewhere else. Resolved DNS names are cached by Wireshark.
- Eray Balkanli about 10 years
  
  They are already captured files. Thank you for ur answer Thaddeus.
Eray Balkanli about 10 years

May I ask, when I write "http" as filter, I cant see any packet. However, when I write "tcp.port == 80", i can see many packet. Do u think why it happens like that?