Wireshark · Wireshark-users: Re: [Wireshark-users] Removing [TCP segment of a reassembled PDU]and HTTP Continuation or non-HTTP t

["Sake Blok" <sake@xxxxxxxxxx>]



That was my idea to, but unfortunately that does not work in tshark, as this field can only be set on a second pass through the packets (or random access to a specific packet) and tshark is (still) a one-pass analyser...

 

... and the O.P. wanted to monitor things with tshark.

 

Cheers,

 

 

Sake

 

----- Original Message -----

From: Martin Visser

To: djponce@xxxxxxxxxxxx ; Community support list for Wireshark

Sent: Saturday, October 03, 2009 10:11 AM

Subject: Re: [Wireshark-users] Removing [TCP segment of a reassembled PDU]and HTTP Continuation or non-HTTP traffic

For what it's worth a cleaner display filter to not idsplay packets which are "TCP [TCP segment of a reassembled PDU]"  is

"!tcp.reassembled_in"

Regards, Martin

MartinVisser99@xxxxxxxxx

On Sat, Oct 3, 2009 at 2:41 PM, Domingo J. Ponce <djponce@xxxxxxxxxxxx> wrote:

Thanks let me put this to the test and I'll let you know.

j.snelders wrote:
> Hi Domingo,
>
> Does this capture filter help you:
> -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
>
> $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
> -w test2.pcap
>
> Best regards
> Joan
>
>
> On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
>
>> Hello Guys,
>>
>> I use Tshark for network monitoring and sniffing of malicious traffic at
>>
>> work and I am trying to figure out how I can get Tshark to stop showing
>>
>
>
>> packets that are TCP [TCP segment of a reassembled PDU] and HTTP
>> Continuation or non-HTTP traffic.
>>
>> I only need this in Tshark and not Wireshark. I use tshark Live to view
>>
>
>
>> any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
>>
>> see an attack sometimes my out put is flooded with [TCP segment of a
>> reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
>>
>> Sincerely,
>> --
>>
>>
>> Domingo J. Ponce
>>
>> Prolexic Technologies
>>
>> SOC Engineer
>>
>> +1954-620-6002 ext 911
>>
>
>
>
>
>
>


--


Domingo J. Ponce

Prolexic Technologies

SOC Engineer

+1954-620-6002 ext 911

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

---

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe