Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

URGENT Request  : how to create a wireshark filter to display udp packet received on non listening port

Posted on 2014-04-11
3
Medium Priority
?
826 Views
Last Modified: 2014-04-29
we have a windows 2003 r2 64 bit  server and monitored by logic monitor ( snmp monitor)
logic monitor is reporting that the server is receiving many udp packet on non listening ports

i have install wireshark on the server
i have created a query "udp && ip.dst==192.168.49.67" which is showing me all the packets  which are udp and have destination ip as my server ips.

Please let me know if i am on right direction , if so how can i progress it further.
0
Comment
Question by:mohannitin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 26

Expert Comment

by:Fred Marshall
ID: 39994700
Well, I think that wireshark terminology is either:
"capture filter"
or
"display filter"
(and not "query").
This is important because the notation for the two are unfortunately different!!

What you have appears to be a valid display filter.
0
 

Author Comment

by:mohannitin
ID: 39994862
Yes i have a display filter setup? Is there any way i can find out where are udp packets
from and hitting on which port?
0
 
LVL 26

Accepted Solution

by:
Fred Marshall earned 2000 total points
ID: 39995063
Sure.  Just look at the packet list.  The Source and Destination IP addresses are in the default listing I believe.  So that should take care of the IP address question.

Then, you should see in the expanded packet display at the bottom of the window, things like:

User Datagram Protocol, Src Port: snmp (161), Dst Port: 50864 (50864)

Then, after you look at a few of these, if you like you can set a display filter to show just the port or ports of interest.
&& (udp.port==xxxxxx || udp.port==yyyyyy) where xxxxxx is the port number and || is "or".
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A brief overview to explain gateways, default gateways and static routes OR NO - you CANNOT have two default gateways on the same server, PC or other Windows-based network device. In simple terms a gateway is formed when a computer such as a serv…
Resolve DNS query failed errors for Exchange
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question