Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I write a filter in Wireshark that checks if the first packet has some field, then checks the new packets for another field, and if they matched, show what you got:

if (someone has my valid usernames and passwords and can log in successfully to my FTP server) then
  show me the result (the IP addresses and usernames that logged in my FTP server)

Is this possible with Wireshark?

And can Wireshark use memory? (Keep in mind that if the first frame matched, it needs to check subsequent ones.)

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.