协议过滤:dns http ip tcp udp arp icmp ssl smtp ftp msnms oicq bootp websocket
IP端口过滤:
ip.src != 10.0.0.5
tcp.dstport == 888
udp.srcport == 888
dst host 220.181.111.188
http.host contains "163.com"
eth.dst==A0:00:00:04:C5:84
HTTP模式过滤:
请求方法为GET:http.request.method==“GET”
请求方法为POST:http.request.method==“POST”
指定URI:http.request.uri==“/img/logo-edu.gif”
请求或相应中包含特定内容:http contains “FLAG”
长度过滤:
frame.len > 10
udp.length==20
特征过滤:
tcp.flags.syn == 0x02
检测tcp含有十六进制01:bd,从tcp头部开始搜索此数据。
tcp matches "\\x01\\xbd"
oicq and udp[8:] matches "^\\x02[\\x00-\\xff][\\x00-\\xff]\\x00\\x22[\\x00-\\xff]+\\x03$"
1、wireshark基本的语法字符