zoukankan      html  css  js  c++  java
  • wireshark和tcpdump的过滤器用法


    ##########################################
    # Generate Filter tool:
    # https://www.wireshark.org/tools/string-cf.html
    #
    # GET Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    # POST Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # PUT Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420
    # DELETE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20
    # HEAD Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # HTTP RESPONSE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e

    tcpdump -Avvvnn "tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e)"

  • 相关阅读:
    Direct hosting of SMB over TCP/IP
    学习 Linux,302(混合环境): 概念
    脚本
    linux加入windows域
    Internet传输协议-TCP
    vCenter Single Sign On 5.1 best practices
    Zoning and LUN Masking
    Fiber Channel SAN Storage
    How to check WWN and Multipathing on Windows Server
    在Windows中监视IO性能
  • 原文地址:https://www.cnblogs.com/mrcoolfuyu/p/13972639.html
Copyright © 2011-2022 走看看