Ethereal expressions - help
Results 1 to 8 of 8

Thread: Ethereal expressions - help

  1. #1
    Senior Member
    Join Date
    Mar 2003
    Posts
    372

    Ethereal expressions - help

    I wasn't real sure where to drop this thread, so for now I'm going to put it here in Miscellaneous Security.

    Anyway, I use Ethereal a lot but I don't use advanced filtering techniques as usually I'm not capturing thousands of packets. That has recently changed, due to a bug/security issue I'm having to research. My captures are winding up in the tens of thousands of packets, most of which I don't need to see for what I'm researching. What I'm looking to do is filter out TCP [PSH, ACK] packets with a Len=81 or Len=162 which are the packets that I'm interested in.

    I can't figure out how to create an expression that shows me just those packets. I'm sure it is something pretty easy that I'm over looking, but I have been banging my head for the past couple of days on this and I don't have a lot of time to play around trying to create this stuff (too many other projects breathing down my neck). So I hope someone here on AO has an idea of what I need to do for this expression/filter.

    If you need further information to create this expression/filter please let me know. Thanks in advance guys

    Give a man a match and he will be warm for a while, light him on fire and he will be warm for the rest of his life.

  2. #2
    Banned
    Join Date
    Nov 2005
    Posts
    62
    tcp.len==81 || tcp.len==162

  3. #3
    Senior Member
    Join Date
    Mar 2003
    Posts
    372
    Thanks csl that is exactly what I was looking for. I didn't know the || join and that is where I was hitting the wall.

    Like I said, something pretty easy I was over looking. Thanks a lot!

    Give a man a match and he will be warm for a while, light him on fire and he will be warm for the rest of his life.

  4. #4
    Senior Member
    Join Date
    Jun 2003
    Posts
    188
    As for length use '(( ip[2:2] >= 81 ) or ( ip[2:2] <= 162) )'

    for ACK and PSH

    '(tcp[tcpflags] & (tcp-push|tcp-ack)!= 0)'

    The whole thing becomes

    '((ip[2:2]>=81) or (ip[2:2]<=162)) and (tcp[tcpflags] & (tcp-push|tcp-ack)!= 0)'

  5. #5
    Senior Member
    Join Date
    Mar 2003
    Posts
    372
    ohh. warl0ck7 I can see how that one would be helpful too... especially if I have packets that are the same size as the PSH, ACK packets that I'm looking for.

    But why use ((ip[2:2)>=81) or (ip[2:2]>=162)) instead of tcp.len==81||tcp.len==162 as suggested by csl?

    Give a man a match and he will be warm for a while, light him on fire and he will be warm for the rest of his life.

  6. #6
    Banned
    Join Date
    Nov 2005
    Posts
    62
    (tcp.flags.syn || tcp.flags.ack) && (tcp.len==81 || tcp.len==162) works as well

  7. #7
    Senior Member
    Join Date
    Jun 2003
    Posts
    188
    Wrong actually, tcp.len gives the length of tcp payload and not of the whole packet
    for the whole packet lenght you need ip[2:2]. also using tcp.len gives me a parse error(??).

  8. #8
    Banned
    Join Date
    Nov 2005
    Posts
    62
    Field name Type Description Versions
    tcp.len Unsigned 32-bit integer TCP Segment Len 0.9.4 to 0.10.13
    http://www.ethereal.com/docs/dfref/t/tcp.htm

    indeed, what was i thinking? oh well, oops.. change tcp.len to (tcp.len+tcp.hdr_len)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •