WireSharp语法过滤器
介绍 | 语法 |
---|---|
不管端口是来源还是目标 | tcp.port eq 80 |
过滤来源是某个ip | ip.src eq 192.168.60.122 |
过滤目标ip | ip.dst eq 192.168.1.107 |
不区分是源还是目标 | ip.dst eq 192.168.1.107 |
tcp的目标端口 | tcp.dstport == 80 |
端口范围过滤 | tcp.port >= 1 and tcp.port <= 80 |
过滤目标mac | eth.dst == A0:00:00:04:C5:84 |
过滤来源mac | eth.src eq A0:00:00:04:C5:84 |
等于 | eq |
大于 | gt |
大于等于 | ge |
不等 | ne |
包长过滤 | udp.length == 26 |
tcp包长度 | tcp.len >= 7 |
数据包长度 | frame.len == 119 |
http请求方式 | http.request.method == “GET” |
http的uri | http.request.uri == “/img/logo-edu.gif” |
get包 | http.request.method == “GET” && http contains "User-Agent: " |
post包 | http.request.method == “POST” && http contains "User-Agent: " |
响应包 | http contains “HTTP/1.1 200 OK” && http contains "Content-Type: " |