Ask Your Question
0

Filter expression help request

asked 2019-12-03 23:07:08 +0000

I was using this expression but it stopped working.

!(ip.addr == 208.67.222.220,208.67.222.222,208.67.220.220) tcp.port == 53 || udp.port == 53

What did I do wrong?

Thanks, Curt [email protected]

edit retag flag offensive close merge delete

Comments

Can you describe what the filter is supposed to match or not match?

bubbasnmp gravatar imagebubbasnmp ( 2019-12-03 23:09:47 +0000 )edit

not match 208.67.222.220,208.67.222.222,208.67.220.220 and equal tcp.port == 53 || udp.port == 53 to find bad recursive DNS requests

Guerrette gravatar imageGuerrette ( 2019-12-03 23:29:32 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-12-03 23:38:51 +0000

bubbasnmp gravatar image
!ip.addr in { 208.67.222.220 208.67.222.222 208.67.220.220} and (tcp.port == 53 || udp.port == 53)
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-12-03 23:07:08 +0000

Seen: 31 times

Last updated: Dec 03