filtering by domain

filter, networking, pcap, tshark, wireshark

Solution

Assuming it's http web traffic, try `http.host contains ".com"`

Better yet, try `http.host matches "\.com$"`

Neither one will require DNS resolution since they search on the web host.

From http://wiki.wireshark.org/DisplayFilters

The matches operator makes it possible to search for text in string fields 
and byte sequences using a regular expression, using Perl regular expression 
syntax. Note: Wireshark needs to be built with libpcre in order to be able to 
use the matches operator.

Problem

I want to filter my pcap file by their domains. I mean, I want to see the packets comes on a website ends with ".com", ".org" or ".net". I tried: dns contains "com", ip.src_host == com, ip.src_host == com, http contains "com". None of them worked correctly.

Original source