8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing Habits « Null Byte

8 Wireshark Filters
http://null-byte.wonderhowto.com/inspiration/8-wireshark-filters-every-wiretapper-uses-spy-web-conversations-and-surfing-habits-0134508/

ip.addr ==x.x.x.x

     Find packets with IP address as either source or destination

ip.addr ==x.x.x.x && ip.addr ==x.x.x.x

     conversation filter between the two IP addresses

http or dns

     filter based on protocol

tcp.port==xxx

     filters based on TCP port numbers

tcp.flags.reset==1

     filters to show all TCP resets.  A TCP reset basically kills a TCP connection instantly.

http.request

     Sets a filter for all HTTP GET and POST requests. This will show webpages being accessed for the most part.

tcp contains xxx

     Find TCP packets containing string.

(arp or icmp or dns)

     filter out protocols. The example hides ARP, ICMP, and DNS packets.

Exchange 2010 Ports

TCP/IP and NBT configuration parameters for Windows XP
PREVENT FRAGMENTATION
set MTU size to the same or lesser than the router along the tracert with the smallest MTU allowed.

Find the smallest MTU allowed in the route by process of elimination using:
ping -l ____ server.domain.com -f

(-l = lower case L and means to use ____ packet size, -f means do not fragment.)

I found:
1413 and greater => "needs fragmented" response
1412 - 1395 => timeout response
1394 and lower => response received.