18

Wireshark | Windows

I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a search or filter for the specific string I'm looking for.

Is there a way to do this in Wireshark?

Gerald Combs
  • 6,331
  • 23
  • 35
Mike B
  • 11,570
  • 42
  • 106
  • 165

2 Answers2

23

Open Edit→Find Packet. Under Find select String and under Search In select Packet list.

Gerald Combs
  • 6,331
  • 23
  • 35
  • a bit odd that the search bar is sort of this hidden option. so we just have to know that there's a filter bar and the hidden search bar – dtc Jun 23 '22 at 17:09
0

You can use Microsoft Network Monitor to do the trick.
Open your file in Microsoft Network Monitor.
Right-click on an item in the Description column en choose "Add 'Description' to Display Filter" from the context menu.
The Display Filter is added to the Filter Window.
Hit the Apply button on the filter toolbar.

Examples:

Description == "HTTP:Request, GET / "
Description.contains("Request")

Microsoft Network Monitor 3.4: Search the Description Column | LoveMyTool