Solved

URGENT Request  : how to create a wireshark filter to display udp packet received on non listening port

Posted on 2014-04-11
3
810 Views
Last Modified: 2014-04-29
we have a windows 2003 r2 64 bit  server and monitored by logic monitor ( snmp monitor)
logic monitor is reporting that the server is receiving many udp packet on non listening ports

i have install wireshark on the server
i have created a query "udp && ip.dst==192.168.49.67" which is showing me all the packets  which are udp and have destination ip as my server ips.

Please let me know if i am on right direction , if so how can i progress it further.
0
Comment
Question by:mohannitin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 26

Expert Comment

by:Fred Marshall
ID: 39994700
Well, I think that wireshark terminology is either:
"capture filter"
or
"display filter"
(and not "query").
This is important because the notation for the two are unfortunately different!!

What you have appears to be a valid display filter.
0
 

Author Comment

by:mohannitin
ID: 39994862
Yes i have a display filter setup? Is there any way i can find out where are udp packets
from and hitting on which port?
0
 
LVL 26

Accepted Solution

by:
Fred Marshall earned 500 total points
ID: 39995063
Sure.  Just look at the packet list.  The Source and Destination IP addresses are in the default listing I believe.  So that should take care of the IP address question.

Then, you should see in the expanded packet display at the bottom of the window, things like:

User Datagram Protocol, Src Port: snmp (161), Dst Port: 50864 (50864)

Then, after you look at a few of these, if you like you can set a display filter to show just the port or ports of interest.
&& (udp.port==xxxxxx || udp.port==yyyyyy) where xxxxxx is the port number and || is "or".
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A brief overview to explain gateways, default gateways and static routes OR NO - you CANNOT have two default gateways on the same server, PC or other Windows-based network device. In simple terms a gateway is formed when a computer such as a serv…
This is the first one of a series of articles I’ll be writing to address technical issues that are always referred to as network problems. The network boundaries have changed, therefore having an understanding of how each piece in the network  puzzl…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question