Filter expression help request

I was using this expression but it stopped working.

!(ip.addr == 208.67.222.220,208.67.222.222,208.67.220.220) tcp.port == 53 || udp.port == 53

What did I do wrong?

Comments

Can you describe what the filter is supposed to match or not match?

Chuckc ( 2019-12-03 23:09:47 +0000 )edit

not match 208.67.222.220,208.67.222.222,208.67.220.220 and equal tcp.port == 53 || udp.port == 53 to find bad recursive DNS requests

Guerrette ( 2019-12-03 23:29:32 +0000 )edit

Sort by » oldest newest most voted

Chuckc
3023 ●6 ●608 ●20

!ip.addr in { 208.67.222.220 208.67.222.222 208.67.220.220} and (tcp.port == 53 || udp.port == 53)

Please start posting anonymously - your entry will be published after you log in or create a new account.

Asked: 2019-12-03 23:07:08 +0000

Seen: 580 times

Last updated: Dec 03 '19