Solved

URGENT Request  : how to create a wireshark filter to display udp packet received on non listening port

Posted on 2014-04-11
3
763 Views
Last Modified: 2014-04-29
we have a windows 2003 r2 64 bit  server and monitored by logic monitor ( snmp monitor)
logic monitor is reporting that the server is receiving many udp packet on non listening ports

i have install wireshark on the server
i have created a query "udp && ip.dst==192.168.49.67" which is showing me all the packets  which are udp and have destination ip as my server ips.

Please let me know if i am on right direction , if so how can i progress it further.
0
Comment
Question by:mohannitin
  • 2
3 Comments
 
LVL 25

Expert Comment

by:Fred Marshall
ID: 39994700
Well, I think that wireshark terminology is either:
"capture filter"
or
"display filter"
(and not "query").
This is important because the notation for the two are unfortunately different!!

What you have appears to be a valid display filter.
0
 

Author Comment

by:mohannitin
ID: 39994862
Yes i have a display filter setup? Is there any way i can find out where are udp packets
from and hitting on which port?
0
 
LVL 25

Accepted Solution

by:
Fred Marshall earned 500 total points
ID: 39995063
Sure.  Just look at the packet list.  The Source and Destination IP addresses are in the default listing I believe.  So that should take care of the IP address question.

Then, you should see in the expanded packet display at the bottom of the window, things like:

User Datagram Protocol, Src Port: snmp (161), Dst Port: 50864 (50864)

Then, after you look at a few of these, if you like you can set a display filter to show just the port or ports of interest.
&& (udp.port==xxxxxx || udp.port==yyyyyy) where xxxxxx is the port number and || is "or".
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

A common practice in small networks is making file sharing easy which works extremely well when intra-network security is not an issue. In essence, everyone, that is "Everyone", is given access to all of the shared files - often the entire C: drive …
Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now