Wireshark: Difference between revisions
→Membership Operator
| (3 intermediate revisions by the same user not shown) | |||
Line 13:
== Wireshark Common Filters ==
{| class="wikitable"
|-
! Description !! English !! Alias !! C-like !! Example
|-
|-
| Not equal (all if more than one) || ne || all_ne || != || ip.src != 10.0.0.5
|-
| Equal (all if more than one) || || all_eq || === || ip.src === 10.0.0.5
|-
|-
| Greater than || gt || || > || frame.len > 10
|-
| Less than || lt || || < || frame.len < 128
|-
| Greater than or equal to || ge || || >= || frame.len ge 0x100
|-
| Less than or equal to || le || || <= || frame.len <= 0x20
|-
| Protocol, field or slice contains a value || contains || || || sip.To contains "a1762"
|-
| Protocol or text field matches a Perl-compatible regular expression || matches || || ~ || <nowiki>http.host matches "acme\\.(org|com|net)"</nowiki>
|}
=== Combining Expressions ===
{| class="wikitable"
!Description !! English !! C-like !! Example
|-
|Logical AND || and || && || ip.src==10.0.0.5 and tcp.flags.fin
|-
| Logical OR || or || <nowiki>||</nowiki> || ip.src==10.0.0.5 or ip.src==192.1.1.1
|-
| Logical XOR || xor || ^^ || tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29
|-
| Logical NOT || not || ! || not llc
|}
=== Membership Operator ===
* Below are equivalent:
tcp.port in {80, 443, 8080} --> tcp.port == 80 || tcp.port == 443 || tcp.port == 8080
http.request.method in {"HEAD", "GET"}
ip.addr in {10.0.0.5 .. 10.0.0.9, 192.168.1.1..192.168.1.9}
tcp.port in {443,4430..4434}
* More Details: [https://www.wireshark.org/docs/dfref/ Reference]
| |||