wireshark question - port monitoring

[ViviTheMage]

Is it possible to watch all traffic, with wireshark, going across port 6000 on a computer? I am trying to diagnose a specific issue, and there doesn't seem to be a filter option for this, or I am missing something.

I just want to know if a source computer (will have wireshark running/installed), has any traffic going over 6000 throughout the day.

Unless there is an easier application for this? I need to monitor this port specifically, in Windows 7.

I need to log it throughout the day, so basically just start the logger/wireshark, and let it run in the background, capturing icmp/http/ALL traffic going across this port.

 

[imagoon]

Have you tried using:

"port 6000"

In the capture filter?

 

[ViviTheMage]

I did, and it didn't capture anything.

I also tried port 80, and browsed some sites, nothing was filtered/captured.

 

[imagoon]

Ok you more likely seeing a "wireshark" issue.

If you start it with no filters does it start grabbing data? Do you have the right interface selected? Since Windows 7 has like 6 of them by default it is easy to miss. Did you install the WinPcap drivers?

 

[ViviTheMage]

I got it, I must not have selected the proper adapter, then the proper port label to capture.

It's not showing everything on the port, thanks .

 

[robmurphy]

If you are going to leave wireshark running disable the update of the screen, and set the capture to be with multiple files.

Best way of capturing for a long session is to use dumpcap, with multiple files. I would suggest a file size of 5 or 10 MB.

I have never been able to get the capture filters to work in wireshark. The filter in the box at the top just filters what is displayed.

The reason for disabling the live update is that wireshark runs out of memory. The reason for keeping the capture file relatively small is again memory.

Its possible to use scripts/batch file to invoke dumpcap after the capture and have this filter the captured files. The filter syntax is , from memory, much the same as the one used to filter the display.

Rob

 

[Railgun]

NM...saw you got it...