VII. Router Diagnostics

Capturing Packets

To make a packet capture with Wireshark, first of all set up the packet capturing environment, for instance if it's necessary to capture packets from the whole network or WAN interface of a DrayTek router, set up the Port Mirroring first, details on that can be found in this guide.

With that set up, click the Capture Options button in the main toolbar:

In that window, select the network interfaces to capture from, untick the Name Resolution options if any are currently ticked. Click Start to start the packet capture:

---

This will show packets as they are received by the PC performing the packet capture:

Once the packet capture shows the necessary information, click the red Stop button in the main toolbar, then click the Save button to save the packet data into a .pcap packet capture file, which will include all details of the packets and the packet data they contain:

When saving the packet capture file, it can be useful to set the Compress with gzip option so that the packet capture is compressed using gzip, this can significantly decrease the size of the packet capture which may be useful if sending it over the internet:

Filtering Packet Captures

When capturing packets on a network, there will often be many packets that aren't useful which may make it difficult to find the correct information. To resolve this, use the Display Filter in Wireshark; there are details on how to use the display filter on Wireshark's website which give examples of the syntax that can be used.

This guide will give some examples of how packets captured can be filtered and how to save the resulting filtered list of packets instead of the full packet capture.

---

To start with, start a packet capture so that packets have been captured. The Display Filter can be applied while packet capture is still active or has been stopped.

Example 1 - Protocol - DHCP

To filter based on the protocol used, enter the protocol name into the Display Filter box, this example will show DHCP packets, which are part of the "bootp" protocol.

Entering that into the filter box will highlight in Green, which indicates that the filter entered has the correct syntax.

If the filter box is highlighted in Red, that indicates that the syntax is incorrect. Click the Expression... button for a list of valid items.

Click Apply to apply that filter, which will then show only DHCP / BOOTP packets in the packet list:

Click Clear to clear the filter, which will show all packets in the packet list.

---

Example 2 - Address - IP Address

To filter based on the IP Address used in a packet, there are a few options that can be used, this example will show how to filter for packets with 192.168.1.1 as either a source or destination.

• ip.addr == 192.168.1.1 - this will show all packets that have 192.168.1.1 in either the source or destination field of a packet
• ip.dst == 192.168.1.1 - this will show packets that have 192.168.1.1 in the destination field of a packet, which would be packets sent to 192.168.1.1
• ip.src == 192.168.1.1 - this will show packets that have 192.168.1.1 in the source field of a packet, which would be packets sent from 192.168.1.1

Click Apply to apply the filter, click Clear to clear the filter.

---

Example 3 - Filtering based on a selected packet

It is also possible to filter based on the information in a selected packet, to find all packets with the same details or hide packets with those details. To do that, select a packet from the Packet List and expand the details in the Packet Details view, this example shows that the User Datagram Protocol details section has been expanded and the source port used has been selected.

With a detail selected, Right-Click that detail and it will show options, select Apply as Filter and click Selected:

This will then create the text for the Display Filter and apply it, which will then show only packets matching that criteria:

Click Clear to clear that filter text and display all packets.

---

Saving the filtered packets

To save filtered list of packets instead of the full packet capture, go to File and click Export Specified Packets:

This will display a dialog box which allows selecting which packets to save; to save only the filtered packets, select All Packets and select the Displayed column, which will be the number of packets currently displayed with the display filter applied.

It is also possible to select the Compress with gzip option to compress the packet capture, which will usually result in a significantly smaller file.

Click Save to save the filtered packet capture: