{"id":310,"date":"2019-08-18T20:35:06","date_gmt":"2019-08-18T18:35:06","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=310"},"modified":"2026-05-22T17:01:21","modified_gmt":"2026-05-22T15:01:21","slug":"wireshark","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=310","title":{"rendered":"Wireshark"},"content":{"rendered":"\n

See a pack\u00adet in its context<\/p>\n\n\n\n

Kontextmen\u00fc, Follow ausw\u00e4hlen<\/pre>\n\n\n\n
Show only ICMP<\/span> pack\u00adets from a host<\/p>\n\n\n\n
tcpdump host 10.11.1.128 and icmp -i tun0<\/pre>\n\n\n\n
Show oth\u00ader sys\u00adtems com\u00admu\u00adni\u00adcat\u00ading out\u00adside the own address<\/p>\n\n\n\n
ip.addr == 10.11.1.0\/24 && !(ip.addr == 192.168.119.0\/24) && ! dns && !browser && !ssdp && !nbns && !llmnr<\/pre>\n\n\n\n
Record audio<\/h2>\n\n\n\n
Wire\u00adshark can trans\u00adform cap\u00adtured audio streams. See tele\u00adpho\u00adny in the task thing.<\/p>\n\n\n\n
Analysing out\u00adput with LLMs<\/p>\n\n\n\n
    \n
  1. Store a dump in t pcap(ng) file<\/li>\n\n\n\n
  2. Trans\u00adform it into json:
    tshark \u2011r cap.pcapng \u2011T json > f.json<\/li>\n\n\n\n
  3. Add it into a model.<\/li>\n<\/ol>\n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    See a pack\u00adet in its con\u00adtext Kon\u00adtextmen\u00fc, Fol\u00adlow ausw\u00e4hlen Show only ICMP<\/span> pack\u00adets from a host tcp\u00addump host 10.11.1.128 and icmp \u2011i tun0 Show oth\u00ader sys\u00adtems com\u00admu\u00adni\u00adcat\u00ading out\u00adside the own address ip.addr == 10.11.1.0\/24 &<\/span>&<\/span> !(ip.addr == 192.168.119.0\/24) &<\/span>&<\/span> ! dns &<\/span>&<\/span> !brows\u00ader &<\/span>&<\/span> !ssdp &<\/span>&<\/span> !nbns &<\/span>&<\/span> !llm\u00adnr Record audio Wire\u00adshark can trans\u00adform cap\u00adtured audio [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[469,470,472,474,475,476,477],"tags":[18,86],"class_list":["post-310","post","type-post","status-publish","format-standard","hentry","category-passive-enum","category-active-enum","category-postexp","category-lateral-movement","category-attack-tool","category-defence-tool","category-software","tag-sniffing","tag-wireshark"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=310"}],"version-history":[{"count":5,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/310\/revisions"}],"predecessor-version":[{"id":4936,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/310\/revisions\/4936"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}