9

I am using WireShark to analyse millions of packets. Is there a filter which will only show those packets which have errors?

By "error", I mean an IP error (e.g. incorrect IP header checksum), an TCP error (e.g. incorrect TCP checksum), or an error at the application layer (in my case, the FIX protocol, which is parsed by WireShark).

How can I configure WireShark to only show erroneous packets?

Improve this question

2 Answers 2

Reset to default
13

The only notion Wireshark has of "error" as a generic concept is the notion of "expert info" items with a severity level of "error" (which is the highest level of severity).

To find all packets with that type of "expert info" item, use the display filter

expert.severity == error

in Wireshark 1.10.x and earlier and

_ws.expert.severity == error

in Wireshark 1.12 and later.

However, that will only show errors if the Wireshark dissector for the protocol where there's the error has code that looks for the error in question and, if it finds it, adds an expert info item for that error. (Wireshark is a dumb piece of software, not a clever networking expert that can detect errors other than the ones it's been written to detect.)

Improve this answer
4
  • Your paragraph "However.." is misplaced given you're addressing somebody that uses Wireshark - (probably not an ignoramous), and it's also misleading because it suggests wireshark is too limited to specifically do what the questioner suggested, but if anybody here knows the Math to do those checksums and can make a filter out of it then Wireshark could do it.
    – barlop
    Aug 7, 2013 at 7:48
  • One might not be an ignoramus and still not realize that it will not necessarily catch arbitrary errors in the FIX protocol - errors that might not involve checksums (BTW, given that checksums depend on the packet data, and that you can't perform arbitrary calculations in a packet filter, you can't write your own filter to check checksums; fortunately, you don't have to, as that's a case where Wireshark does do the calculation and check the checksum for you).
    – user164970
    Aug 7, 2013 at 22:45
  • 1
    _ws.expert.severity==error used instead
    – Devendra
    Apr 29, 2015 at 19:45
  • That was a change between Wireshark 1.10 (which didn't have the "_ws." prefix for that field, and which was the current version at the time) and Wireshark 1.12 (which did have that prefix, and which was released in July 2014). I've updated the answer.
    – user164970
    Apr 30, 2015 at 6:33
3

Sample more specific error filters:

_ws.expert.group == Malformed
_ws.expert.severity != Ok
_ws.expert.message ~ "A new tcp session is started with the same ports"

  1. Group names:

    Checksum, Sequence, Response, Request, Undecoded, Reassemble, Malformed, Debug, Protocol, Security, Comment

  2. Severity levels:

    Error, Warn, Note, Chat, Comment, Ok

  3. Messages

    Can be looked up on a packet content view on sample problematic packet, in the analysis section in Expert Info node. E.g. Transmission Control Protocol/[SEQ/ACK analysis]/[TCP Analysis Flags]/[Expert Info]

This builds on the answer by user164970

Improve this answer
1
  • 2
    _ws.expert.severity != Ok was very useful.
    – Timo
    Jun 18, 2018 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .