packet content) and if the packets contain encrypted data. The answer is that it depends on where the text string is (like header vs. Our Udemy course on Wireless Packet capture Our custom profiles repository for Wireshark In one of my next posts, I will introduce the Top Users Experts, a Network Monitor extension that allows you to analyze the bandwidth consumption on a host.5 of 5 - 4 votes Thank you for rating this article.Ī common question regarding Wireshark packet analysis is 'Can I find a text string in a packet capture?'Ĭheck out these great references as well: All of them can only be applied to a capture file but not to the current Capture tab. This makes using the tool a bit unsuitable for quick and dirty searches, but this is a problem with all Network Monitor Experts. Moreover, it is not possible to search within a Capture tab that is, you always have to save the captured data to a capture file and then open the file with Network Monitor, before you can use Simple Search.

Unfortunately, you can't use Simple Search to search in multiple capture files. The option ' Automatically Discover Search File' allows you to use Simple Search for another capture file instead of the original file i.e., the one you selected when you launched Simple Search. However, like Network Monitor's search tool, it can't highlight the search string there. Simple Search can also select the corresponding frame in Network Monitor. Enabling 'Automatically Display Raw Data' will open this tab whenever you click on 'Find Next' and it will highlight the search string in the text column. If you enable 'Record Raw Data' in the search options in the lower pane, then a new tab named Hex Details will appear. The feature l like most, however, is Simple Search's ability to jump directly to the position where the string was found. If you want it a bit more complicated, then you can also use regular expressions. To search for a string, you can just enter it as is. With Simple Search, it is easier and also much more convenient to search for a specific search string than it is with Network Monitor's integrated search function. For example, if you want to search for a string in the TCP payload, you have to use this command: property: TCPPayload contains ('search string'). However, this also makes it a bit complicated to use for those who use the tool only every now and then. It is a powerful tool because you can leverage Network Monitor's filters. Network Monitor has its own search function.

Wireshark search for string in payload