Solved

URGENT Request  : how to create a wireshark filter to display udp packet received on non listening port

Posted on 2014-04-11
3
765 Views
Last Modified: 2014-04-29
we have a windows 2003 r2 64 bit  server and monitored by logic monitor ( snmp monitor)
logic monitor is reporting that the server is receiving many udp packet on non listening ports

i have install wireshark on the server
i have created a query "udp && ip.dst==192.168.49.67" which is showing me all the packets  which are udp and have destination ip as my server ips.

Please let me know if i am on right direction , if so how can i progress it further.
0
Comment
Question by:mohannitin
  • 2
3 Comments
 
LVL 25

Expert Comment

by:Fred Marshall
ID: 39994700
Well, I think that wireshark terminology is either:
"capture filter"
or
"display filter"
(and not "query").
This is important because the notation for the two are unfortunately different!!

What you have appears to be a valid display filter.
0
 

Author Comment

by:mohannitin
ID: 39994862
Yes i have a display filter setup? Is there any way i can find out where are udp packets
from and hitting on which port?
0
 
LVL 25

Accepted Solution

by:
Fred Marshall earned 500 total points
ID: 39995063
Sure.  Just look at the packet list.  The Source and Destination IP addresses are in the default listing I believe.  So that should take care of the IP address question.

Then, you should see in the expanded packet display at the bottom of the window, things like:

User Datagram Protocol, Src Port: snmp (161), Dst Port: 50864 (50864)

Then, after you look at a few of these, if you like you can set a display filter to show just the port or ports of interest.
&& (udp.port==xxxxxx || udp.port==yyyyyy) where xxxxxx is the port number and || is "or".
0

Featured Post

Superior storage. Superior surveillance.

WD Purple drives are built for 24/7, always-on, high-definition security systems. With support for up to 8 hard drives and 32 cameras, WD Purple drives are optimized for surveillance.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
VPN 101 - how and which protocol? 9 95
Sonicwall AP 3 56
OWA and AppPool problem 20 126
restore DAG configuration 1 35
Have you ever set up your wireless router at home or in the office to find that you little pop-up bubble in the bottom right-hand corner of Windows read "IP Conflict - One of more computers on the network have been assigned the following IP address"…
Preface There are many applications where some computing systems need have their system clocks running synchronized within a small margin and eventually need to be in sync with the global time. There are different solutions for this, i.e. the W3…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now