Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 131)

Type Example

IPX address ipx.addr == 00000000.ffffffffffff

String (text) http.request.uri == "http://www.wireshark.org/"

6.4.3. Combining expressions

You can combine filter expressions in Wireshark using the logical operators shown in Table 6.5,

“Display Filter Logical Operations”

Table 6.5. Display Filter Logical Operations

English C-like Description and example

and &&

Logical AND

ip.src==10.0.0.5 and tcp.flags.fin

or ||

Logical OR

ip.scr==10.0.0.5 or ip.src==192.1.1.1

xor ^^

Logical XOR

tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29

not !

Logical NOT

not llc

[...]

Substring Operator

Wireshark allows you to select subsequences of a sequence in rather elab-

orate ways. After a label you can place a pair of brackets [] containing a

comma separated list of range specifiers.

eth.src[0:3] == 00:00:83

The example above uses the n:m format to specify a single range. In this

case n is the beginning offset and m is the length of the range being spe-

cified.

eth.src[1-2] == 00:83

The example above uses the n-m format to specify a single range. In this

case n is the beginning offset and m is the ending offset.

eth.src[:4] == 00:00:83:00

The example above uses the :m format, which takes everything from the

Working with captured packets

116

1 2 ... 126 127 128 129 130 131 132 133 134 135 136 ... 283 284

Keine Kommentare

Wireshark - 1.0 Betriebsanweisung Seite 131