Wireshark-users: [Wireshark-users] Removing [TCP segment of a reassembled PDU] and HTTP Continuat
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Domingo J. Ponce" <djponce@xxxxxxxxxxxx>
Date: Fri, 02 Oct 2009 08:05:19 -0400
Hello Guys,
I use Tshark for network monitoring and sniffing of malicious traffic at work and I am trying to figure out how I can get Tshark to stop showing packets that are TCP [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP traffic.
I only need this in Tshark and not Wireshark. I use tshark Live to view any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do see an attack sometimes my out put is flooded with [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP traffic responses. 

Sincerely,
--


Domingo J. Ponce

Prolexic Technologies

SOC Engineer

+1954-620-6002 ext 911