How to make display filter case insensitive [WireShark 4.2.6]
I am studying a PCAP that is a sample of a LLMNR poisoning attack. The following filter works:
udp.port == 5355 && dns.flags.response == True && ( ip.source ne dns.resp.name )
I would like to make the ip.source ne dns.resp.name comparison case insensitive. I have tried the following but these turn the filter input field to red which I assume to be some sort of syntax error.
udp.port == 5355 && dns.flags.response == True && ( ip.source matches dns.resp.name )
udp.port == 5355 && dns.flags.response == True && ( ip.source matches "(?-i)cldc" dns.resp.name )
udp.port == 5355 && dns.flags.response == True && ( upper(string(ip.source)) != upper(string(dns.resp.name)) )
How do I make the ip.source ne dns.resp.name comparison case insensitive?
What is
ip.source? Do you meanip.src_host?Good catch. This returns a smaller set of packets that gets me closer to what I need.
udp.port == 5355 && dns.flags.response == True && ( ip.src_host ne dns.resp.name )This still change the display filter input field to red:
udp.port == 5355 && dns.flags.response == True && ( ip.src_host matches dns.resp.name )This will run but returns results that don't actually match what I need.
udp.port == 5355 && dns.flags.response == True && ( upper(ip.src_host) ne upper(dns.resp.name) )Could you point to the download location of the LLMNR poisoning attack sample (or share it yourself) and then indicate which packets you want the filter to match?
The PCAP I'm analyzing is here: https://app.hackthebox.com/sherlocks/.... The theory I'm testing is that the rogue LLMNR device will respond to requests for host names that are not itself, i.e. rogue device
foowill respond to queries for devicebar.When the display filter input field is red, a status message explaining why the filter didn't compile is added to the status bar at the bottom of the Wireshark window. What does it say? You shouldn't have to "guess" whether a filter has a syntax or syntactical error and why, the error message should tell you. If it's not clear enough, perhaps it could be changed.