I am trying to figure out how to reduce the amount of packets I capture on incoming dicom requests. I came across this HTTP Get capture filter and am trying to modify it to capture certain dicom packets only. I was hoping someone might be able to help me get the syntax right.
This filter looks for the bytes 'G', 'E', 'T', and (hex values 47, 45, 54, and 20) just after the TCP header. "tcp[12:1] & 0xf0) >> 2" figures out the TCP header length. From Jefferson Ogata via the tcpdump-workers mailing list.
port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
In need to figure out how to do this exact same thing for the “Called AE Title” line but to capture the letters “Fuji”. Since it is not immediately after the TCP header and there are several other bytes in between, I cannot figure out the offsets. The Letter F starts exactly 11 bytes after the last byte in the TCP header.
Bytes 'F', ‘u', 'j', ‘i’, are (hex values 46, 75, 6a, and 69)
