What if I just wanted to see the packets with 'BHI' in them?įor this we need to use the Display Filter functionality of Wireshark. Whether I had entered 'bhi' or 'bHi' or 'bhI', the search will find the same packet. Eventually I will reach the end of the capture and have to reset the view to the first packet to initiate the search once again. This was the first instance, and if I clicked find again, Wireshark will look further into the capture. Packet 246 has this string and Wireshark highlights this. Now select packet bytes if you want to look inside the packets, and then type the string you are looking for in the entry box and click on find:Ībove, you can see I selected string, packet bytes, entered 'BHI' as my string and then clicked find. To find a string, select string, and note that the two other drop down boxes are no longer greyed out. You will note the 'Display filter' drop down just to the left of the string entry box. When you click on this looking glass button, or select Edit> Find Packet from the drop down menus, you will be presented with the following toolbar immediately below the display filter toolbar: If you would like to see this - check out our video:įirst there is the generic find/search capability in Wireshark that is found here:

Anything in the tunnel will be and therefore not searchable.Īlright, let's talk about what tools come in Wireshark to find a string. Most packet headers outside such a tunnel are always searchable and not encrypted. If you are looking for a string in the packet headers, it will depend on whether the header was inside or outside a VPN tunnel. However, if they are using HTTP or some other clear text protocol, then you will be able to find a string in the packet contents. If you are looking for something like 'password' in the contents of packets, and the user was on an HTTPS connection, then you will not find this string. packet content) and if the packets contain encrypted data. The answer is that it depends on where the text string is (like header vs. Our Udemy course on Wireless Packet capture Our custom profiles repository for Wireshark 5 of 5 - 4 votes Thank you for rating this article.Ī common question regarding Wireshark packet analysis is 'Can I find a text string in a packet capture?'Ĭheck out these great references as well:

Wireshark decrypt ssl only partial