Wireshark - 0.99.5 Podręcznik Użytkownika Pobierz pdf (Strona 125)

English C-like Description and example

Greater than or equal to

frame.pkt_len ge 0x100

Less than or equal to

frame.pkt_len <= 0x20

In addition, all protocol fields are typed. Table 6.4, “Display Filter Field Types” provides a list of

the types and example of how to express them.

Table 6.4. Display Filter Field Types

Type Example

Unsigned integer (8-bit, 16-bit, 24-bit, 32-bit)

You can express integers in decimal, octal, or

hexadecimal. The following display filters are

equivalent:

ip.len le 1500

ip.len le 02734

ip.len le 0x436

Signed integer (8-bit, 16-bit, 24-bit, 32-bit)

Boolean

A boolean field is present in the protocol decode

only if its value is true. For example,

tcp.flags.syn is present, and thus true, only if the

SYN flag is present in a TCP segment header.

Thus the filter expression tcp.flags.syn will se-

lect only those packets for which this flag exists,

that is, TCP segments where the segment header

contains the SYN flag. Similarly, to find source-

routed token ring packets, use a filter expression

of tr.sr.

Ethernet address (6 bytes)

Separators can be a colon (:), dot (.) or dash (-)

and can have one or two bytes between separat-

ors:

eth.addr == ff:ff:ff:ff:ff:ff

eth.addr == ff-ff-ff-ff-ff-ff

eth.addr == ffff.ffff.ffff

IPv4 address ip.addr == 192.168.0.1

IPv6 address ipv6.addr == ::1

IPX address ipx.addr == 00000000.ffffffffffff

String (text) http.request.uri == "http://www.wireshark.org/"

6.4.3. Combining expressions

Working with captured packets

111

1 2 ... 120 121 122 123 124 125 126 127 128 129 130 ... 222 223

Brak uwag

Wireshark - 0.99.5 Podręcznik Użytkownika Strona 125