Packet Captures: Difference between revisions
m
→Wireshark Common Filters: m
(→Wireshark Common Filters: table) |
m (→Wireshark Common Filters: m) |
||
Line 226:
|ICMP Fragmentation needed packets || icmp.type==3 and icmp.code==4
|-
|Combination of above two || <nowiki>ip[0,9,20:2]==4501:0304||ip[6:2]&3fff</nowiki>
|-
|Starting and Ending sessions || tcp.flags&7 or (tcp.seq==1 and tcp.ack==1 and !tcp.window_size_scalefactor==-1 and tcp.len==0)
| |||