Ask Your Question
0

Capture Filter using asterisks for anything has keyword *abc.com*

asked 2024-12-17 12:00:59 +0000

nonomer174 gravatar image

updated 2024-12-17 14:57:38 +0000

Chuckc gravatar image

How can i capture filter of a website with any sub-webpage within abc.com , for example:

main.abc.com

abc.com/login

I'm looking for somehow of a string abc.com using astriks

edit retag flag offensive close merge delete

Comments

Capture filter or display filter?
6.3. Filtering Packets While Viewing

Wireshark has two filtering languages: capture filters and display filters.

Chuckc gravatar imageChuckc ( 2024-12-17 14:54:26 +0000 )edit

I mean capture filter

nonomer174 gravatar imagenonomer174 ( 2024-12-17 18:11:56 +0000 )edit

Capture filters at arbitrary locations in the data are tough.

There are some notes here:
String-Matching Capture Filter Generator

Chuckc gravatar imageChuckc ( 2024-12-17 20:20:09 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-12-17 14:08:21 +0000

SYN-bit gravatar image

You can use ... contains "abc.com" like:

  • http.host contains "abc.com"
  • http.referer contains "abc.com"
  • tcp contains "abc.com"
edit flag offensive delete link more

Comments

...as a read filter or a display filter, not a capture filter.

Capture filters can't be implemented with loops, as in-kernel cBPF interpreters don't allow backwards branches, so any loop looking for some data in any position in a packet, or any position within a field of a packet, would have to be completely unrolled, which is a bit difficult if the size of the area to be checked isn't known at the time the filter expression is compiled into code.

Guy Harris gravatar imageGuy Harris ( 2024-12-19 00:14:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-12-17 12:00:59 +0000

Seen: 113 times

Last updated: Dec 17