Wireshark · Wireshark-users: Re: [Wireshark-users] Removing [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP

["Domingo J. Ponce" <djponce@xxxxxxxxxxxx>]

Thanks let me put this to the test and I'll let you know.


j.snelders wrote:
> Hi Domingo,
>
> Does this capture filter help you:
> -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
>
> $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
> -w test2.pcap
>
> Best regards
> Joan
>
>
> On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
>   
> > Hello Guys,
> >
> > I use Tshark for network monitoring and sniffing of malicious traffic at
> >
> > work and I am trying to figure out how I can get Tshark to stop showing
> >     
>
>   
> > packets that are TCP [TCP segment of a reassembled PDU] and HTTP 
> > Continuation or non-HTTP traffic.
> >
> > I only need this in Tshark and not Wireshark. I use tshark Live to view
> >     
>
>   
> > any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
> >
> > see an attack sometimes my out put is flooded with [TCP segment of a 
> > reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
> >
> > Sincerely,
> > --
> >
> >
> > Domingo J. Ponce
> >
> > Prolexic Technologies
> >
> > SOC Engineer
> >
> > +1954-620-6002 ext 911
> >     
>
>
>        
>
>
>   


--


Domingo J. Ponce

Prolexic Technologies

SOC Engineer

+1954-620-6002 ext 911