Wireshark-users: Re: [Wireshark-users] Removing [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP traffic

From: "j.snelders" <j.snelders@xxxxxxxxxx>
Date: Fri, 2 Oct 2009 20:57:02 +0200

Hi Domingo,

Does this capture filter help you:
-f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"

$ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
-w test2.pcap

Best regards
Joan


On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
>
>Hello Guys,
>
>I use Tshark for network monitoring and sniffing of malicious traffic at
>
>work and I am trying to figure out how I can get Tshark to stop showing

>packets that are TCP [TCP segment of a reassembled PDU] and HTTP 
>Continuation or non-HTTP traffic.
>
>I only need this in Tshark and not Wireshark. I use tshark Live to view

>any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
>
>see an attack sometimes my out put is flooded with [TCP segment of a 
>reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
>
>Sincerely,
>-- 
>
>
>Domingo J. Ponce
>
>Prolexic Technologies
>
>SOC Engineer
>
>+1954-620-6002 ext 911