Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

WireShark | Windows

I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a search or filter for the specific string I'm looking for.

Is there a way to do this in WireShark?

share|improve this question
    
Wouldn't it be easier to search yur SMTP logs? –  joeqwerty Oct 19 '10 at 23:10

2 Answers 2

up vote 6 down vote accepted

Open Edit→Find Packet. Under Find select String and under Search In select Packet list.

share|improve this answer
    
Perfect! Thanks! –  Mike B Oct 20 '10 at 7:13

You can use Microsoft Network Monitor to do the trick.
Open your file in Microsoft Network Monitor.
Right-click on an item in the Description column en choose "Add 'Description' to Display Filter" from the context menu.
The Display Filter is added to the Filter Window.
Hit the Apply button on the filter toolbar.

Examples Description == "HTTP:Request, GET / "
Description.contains("Request")

http://www.lovemytool.com/blog/2011/03/microsoft-network-monitor-34-search-the-description-column-by-joke-snelders.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.