zoukankan      html  css  js  c++  java
  • wireshark和tcpdump的过滤器用法


    ##########################################
    # Generate Filter tool:
    # https://www.wireshark.org/tools/string-cf.html
    #
    # GET Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    # POST Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # PUT Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420
    # DELETE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20
    # HEAD Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # HTTP RESPONSE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e

    tcpdump -Avvvnn "tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e)"

  • 相关阅读:
    【JavaScript】照片库
    【JavaScript】事件介绍
    【JavaScript】函数返回值
    【JavaScript】打造自己的函数
    【JavaScript】函数—可重用的代码块
    【JavaScript】循环语句
    【JavaScript】笑话生成器
    【JavaScript】数组
    c#之线程通信
    c#之线程同步
  • 原文地址:https://www.cnblogs.com/mrcoolfuyu/p/13972639.html
Copyright © 2011-2022 走看看