Display filter in 3.7.1 receives invalid syntax

asked 2022-07-27 06:28:40 +0000

mrEEde
4033 ●16 ●48 ●77

I used to filter on bytes strings like

tcp[12:2,14:2]==a012:111c

and get a Invalid filter:"111c" was unexpected in this context in the new release

Is that intended or a bug ? Regards Matthias

edit retag flag offensive close merge delete

Comments

Probably best to raise an issue at GitLab for this, there have been a lot of changes in the filtering code that this might be an unintended regression.

grahamb ( 2022-07-27 08:08:21 +0000 )edit

Created #18227 as a GitLab issue.

mrEEde ( 2022-07-28 14:57:49 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2022-07-28 20:23:01 +0000

mrEEde
4033 ●16 ●48 ●77

As per the discussion in GitLab item #18227 the filter parser no longer supports the colon separating 2-byte strings

The parser now rejects 1503:03 as an invalid byte string. This must be written 150303 or 15:03:03.

edit flag offensive delete link

add a comment

answered 2022-07-27 08:26:30 +0000

Jaap

13742 ●710 ●115

I thinks this has always been supposed to be tcp[12:2,14:2]==a0:12:11:1c, but never enforced. It's being enforced now.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Display filter in 3.7.1 receives invalid syntax

Comments

2 Answers

Your Answer

Question Tools

Stats

Related questions

Display filter in 3.7.1 receives invalid syntax edit

Comments

2 Answers

Your Answer

Question Tools

Stats

Related questions

Display filter in 3.7.1 receives invalid syntax