Search code examples
error-handlingprotocolswiresharkmdns

wireshark protocol filter not working

i have this Wireshark snapshot and im trying to filter for the mdns protocol by just typing: mdns but it's not working. however filtering for http is working fine. whats am i doing wrong? Thanks ![wireshark error] https://www.dropbox.com/s/4zt6nf3f66te5ka/wireshar_pic.PNG?dl=0

Solution

  • Although the Protocol column shows "MDNS", the actual Protocol "field" for display filters to match is "dns", as far as Wireshark is concerned. So using a display filter of "dns" will match DNS packets, including MDNS. To then narrow it down to only MDNS, add the UDP port number of 5353, so the final display filter would be:

    dns and udp.port == 5353

    ...or just "udp.port == 5353" since that's going to be MDNS normally.