Thanks let me put this to the test and I'll let you know.
j.snelders wrote:
Hi Domingo,
Does this capture filter help you:
-f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
$ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
-w test2.pcap
Best regards
Joan
On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
Hello Guys,
I use Tshark for network monitoring and sniffing of malicious traffic at
work and I am trying to figure out how I can get Tshark to stop showing
packets that are TCP [TCP segment of a reassembled PDU] and HTTP
Continuation or non-HTTP traffic.
I only need this in Tshark and not Wireshark. I use tshark Live to view
any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
see an attack sometimes my out put is flooded with [TCP segment of a
reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
Sincerely,
--
Domingo J. Ponce
Prolexic Technologies
SOC Engineer
+1954-620-6002 ext 911
--
Domingo J. Ponce
Prolexic Technologies
SOC Engineer
+1954-620-6002 ext 911
