Capture Filter - Exclude URL Containing Certain String

burritoman
1 ●1 ●1 ●1

Is it possible to use a capture filter to exclude traffic to a given path? The problem I'm faced with is trying to determine hits to a web server but only for certain web applications, excluding a particular one.

Ex.

I want to see traffic on google.com/blah I do not want to see traffic on google.com/bloop

I understand capture filters are more limited than display filters but I'd like to limit the size and overhead of the initial capture by only capturing traffic I want to see. The endgoal is to determine individual IPs making requests to this website, excluding traffic to a given X-Original-URL path.

answered Mar 29 '19

Ross Jacobs
71 ●3 ●32 ●13

updated Mar 30 '19

Capture filters will not be able to do this unless you can specify a different IP address for the server. The problem is that capture filters use a more limited syntax. Capture filters can differentiate source/dest IP and name based on different subdomains/IP addresses. google.com/blah and google.com/bloop; however, both point to the same server. More info can be found on this Stackoverflow question. If somehow there is a different server involved (let's say google.com/drive redirects to drive.google.com), then you can use a capture filter like dst drive.google.com.

Edited: To limit the scope to capture filters

link

Comments

This is a Display filter, not a capture filter.

Jaap ( Mar 30 '19 )

Thanks for the catch @Jaap. Edited question to reflect this.

Ross Jacobs ( Mar 30 '19 )

In particular, they're limited not to be able to do anything involving a loop (so no arbitrary string pattern-matching) or involving string pattern-matching.

Guy Harris ( Mar 30 '19 )

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Capture Filter - Exclude URL Containing Certain String

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Capture Filter - Exclude URL Containing Certain String savecancel

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Capture Filter - Exclude URL Containing Certain String