Wireshark Filter by Domain Name: Understanding Custom Interpretation of Options

Wireshark, a popular network protocol analyzer, allows users to filter packets based on various criteria, including domain names. In this article, we will explore how to use Wireshark filters to extract specific information from captured packets and decode custom options.

Defining Custom Interpretation of Options

When working with packet captures in Wireshark, it's often necessary to define custom interpretations of options to extract meaningful data. This can be achieved using the 'Decode as' option in the protocol tree. For example, we can define a custom interpretation for the Packet Cable CCC option, which is used to configure client-side options.

Packet Cable CCC Option

The Packet Cable CCC (Client Configuration) option is used to transmit client configuration information between the DHCP server and the DHCP client. The option consists of several subfields that contain specific configuration parameters. To decode this option in Wireshark, we need to specify the correct protocol version number. In our example, we can use the value 0x000e (14) to match the time elapsed since the first request.

Interpreting Option Values

When working with packet captures, it's essential to understand how option values are encoded and decoded. For instance, Novell Servers option 85 can be configured as a string instead of an address. This allows us to extract more meaningful information from the captured packets. In our example, we can see that the secs value 0x0e00 (3584 or nearly an hour) was sent by a Windows XP client, even though the client hadn't been retrying for that long.

Wireshark will attempt to detect this and display a message in the packet detail indicating a possible 'little endian bug.' Most versions of Microsoft Windows improperly encode the secs field on the wire as little-endian. This can lead to incorrect interpretation of option values if not properly accounted for.

BOOTP and DHCP

Before diving into custom options, it's essential to understand the underlying protocols used in packet captures. BOOTP (Bootstrap Protocol) is a transport protocol that is used by DHCP (Dynamic Host Configuration Protocol) to dynamically assign IP-address parameters and other settings to clients. RFC3396 'Encoding Long Options in the Dynamic Host Configuration Protocol (DHCPv4)' provides more information on how long options are encoded in DHCP packets.

Wireshark filters can be a powerful tool for extracting specific information from packet captures. By defining custom interpretations of options, we can decode and extract meaningful data from captured packets. This article has demonstrated how to use Wireshark filters to extract information about the Packet Cable CCC option and how to interpret option values in the context of DHCP packets.

In addition, we have discussed the importance of understanding the underlying protocols used in packet captures, such as BOOTP and DHCP. By combining these techniques with custom options and protocol analysis, network administrators can gain valuable insights into network traffic patterns and optimize their network configurations accordingly.

Wireshark filter by domain name