Re: Removing [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP traffic

["Domingo J. Ponce" <djponce () prolexic com>]

Thanks let me put this to the test and I'll let you know.


j.snelders wrote:
> Hi Domingo,
>
> Does this capture filter help you:
> -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
>
> $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
> -w test2.pcap
>
> Best regards
> Joan
>
>
> On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
>   
> > Hello Guys,
> >
> > I use Tshark for network monitoring and sniffing of malicious traffic at
> >
> > work and I am trying to figure out how I can get Tshark to stop showing
> >     
>
>   
> > packets that are TCP [TCP segment of a reassembled PDU] and HTTP 
> > Continuation or non-HTTP traffic.
> >
> > I only need this in Tshark and not Wireshark. I use tshark Live to view
> >     
>
>   
> > any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
> >
> > see an attack sometimes my out put is flooded with [TCP segment of a 
> > reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
> >
> > Sincerely,
> > -- 
> >
> >
> > Domingo J. Ponce
> >
> > Prolexic Technologies
> >
> > SOC Engineer
> >
> > +1954-620-6002 ext 911
> >     
>
>
>        
>
>
>   


-- 


Domingo J. Ponce

Prolexic Technologies

SOC Engineer

+1954-620-6002 ext 911

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe