Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 132)

English C-like Description and example

beginning of a sequence to offset m. It is equivalent to 0:m

eth.src[4:] == 20:20

The example above uses the n: format, which takes everything from offset

n to the end of the sequence.

eth.src[2] == 83

The example above uses the n format to specify a single range. In this case

the element in the sequence at offset n is selected. This is equivalent to

n:1.

eth.src[0:3,1-2,:4,4:,2] ==

00:00:83:00:83:00:00:83:00:20:20:83

Wireshark allows you to string together single ranges in a comma separ-

ated list to form compound ranges as shown above.

6.4.4. A common mistake

Warning!

Using the != operator on combined expressions like: eth.addr, ip.addr, tcp.port,

udp.port and alike will probably not work as expected!

Often people use a filter string to display something like ip.addr == 1.2.3.4 which will display all

packets containing the IP address 1.2.3.4.

Then they use ip.addr != 1.2.3.4 to see all packets not containing the IP address 1.2.3.4 in it. Unfor-

tunately, this does not do the expected.

Instead, that expression will even be true for packets where either source or destination IP address

equals 1.2.3.4. The reason for this, is that the expression ip.addr != 1.2.3.4 must be read as "the

packet contains a field named ip.addr with a value different from 1.2.3.4". As an IP datagram con-

tains both a source and a destination address, the expression will evaluate to true whenever at least

one of the two addresses differs from 1.2.3.4.

If you want to filter out all packets containing IP datagrams to or from IP address 1.2.3.4, then the

correct filter is !(ip.addr == 1.2.3.4) as it reads "show me all the packets for which it is not true that

a field named ip.addr exists with a value of 1.2.3.4", or in other words, "filter out all packets for

which there are no occurrences of a field named ip.addr with the value 1.2.3.4".

Working with captured packets

117

1 2 ... 127 128 129 130 131 132 133 134 135 136 137 ... 283 284

Keine Kommentare

Wireshark - 1.0 Betriebsanweisung Seite 132