First time here? Check out the FAQ!

Ask Your Question
0

Capture Filter using asterisks for anything has keyword *abc.com*

asked Dec 17 '4

nonomer174 gravatar image

updated Dec 17 '4

Chuckc gravatar image

How can i capture filter of a website with any sub-webpage within abc.com , for example:

main.abc.com

abc.com/login

I'm looking for somehow of a string abc.com using astriks

Preview: (hide)

Comments

Capture filter or display filter?
6.3. Filtering Packets While Viewing

Wireshark has two filtering languages: capture filters and display filters.

Chuckc gravatar imageChuckc ( Dec 17 '4 )

I mean capture filter

nonomer174 gravatar imagenonomer174 ( Dec 17 '4 )

Capture filters at arbitrary locations in the data are tough.

There are some notes here:
String-Matching Capture Filter Generator

Chuckc gravatar imageChuckc ( Dec 17 '4 )

1 Answer

Sort by » oldest newest most voted
0

answered Dec 17 '4

SYN-bit gravatar image

You can use ... contains "abc.com" like:

  • http.host contains "abc.com"
  • http.referer contains "abc.com"
  • tcp contains "abc.com"
Preview: (hide)
link

Comments

...as a read filter or a display filter, not a capture filter.

Capture filters can't be implemented with loops, as in-kernel cBPF interpreters don't allow backwards branches, so any loop looking for some data in any position in a packet, or any position within a field of a packet, would have to be completely unrolled, which is a bit difficult if the size of the area to be checked isn't known at the time the filter expression is compiled into code.

Guy Harris gravatar imageGuy Harris ( Dec 19 '4 )

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Dec 17 '4

Seen: 480 times

Last updated: Dec 17 '24