Wireshark D3 V5 - Display filters

The video tutorial covers the use of Wireshark's main toolbar and file management, including opening recent files and accessing statistics. It explains how to apply and negate display filters, with a focus on SSDP packets. The tutorial provides examples of creating and managing display filters for specific traffic types, such as HTTP and IP addresses. Advanced filtering techniques, including IP negation and traffic filtering for protocols like SMB and DNS, are discussed. Finally, the video demonstrates how to manage filter files within Wireshark, including adding, sharing, and organizing filters.

What can you do with the main toolbar in Wireshark?

• Only use it on active files

• Only use it on inactive files

• Use it on both active and inactive files

• It is not used for file operations

How can you view all SSDP packets in Wireshark?

• By using the statistics protocol hierarchy

• By typing 'HTTP' in the display filter

• By opening a recent file

• By typing 'SSDP' in the display filter

What is the purpose of negating an expression in Wireshark?

• To highlight specific packets

• To sort packets by type

• To exclude specific packets

• To include specific packets

Which filter would you use to display only HTTP traffic?

• SSDP filter

• Subnet filter

• TCP port equals 80

• IP address filter

How can you share a custom filter with colleagues in Wireshark?

• By adding it to the D filters file and sharing the file

• By writing it on a piece of paper

• By sending a screenshot

• By using the statistics protocol hierarchy