WinPcap过滤表达式知识.docVIP

WinPcap过滤表达式知识 /CaptureFilters Search: Login CaptureFilters FrontPage RecentChanges FindPage HelpContents CaptureFilters Immutable Page Comments Info Attachments CaptureFilters An overview of the capture filter syntax can be found in the Users Guide. A complete reference can be found in the expression section of the tcpdump manual page. Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library. If you need a capture filter for a specific protocol, have a look for it at the ProtocolReference. Contents 1. CaptureFilters 1. Examples 2. Useful Filters 3. Default Capture Filters 4. Further Information 5. See Also 6. Discussion Examples Capture only traffic to or from IP address · host Capture traffic to or from a range of IP addresses: · net /24 or · net mask Capture traffic from a range of IP addresses: · src net /24 or · src net mask Capture traffic to a range of IP addresses: · dst net /24 or · dst net mask Capture only DNS (port 53) traffic: · port 53 Capture non-HTTP and non-SMTP traffic on your server (both are equivalent): · host and not (port 80 or port 25) host and not port 80 and not port 25 Capture except all ARP and DNS traffic: · port not 53 and not arp Capture traffic within a range of ports · (tcp[0:2] 1500 and tcp[0:2] 1550) or (tcp[2:2] 1500 and tcp[2:2] 1550) or, with newer versions of libpcap (0.9.1 and later): · tcp portrange 1501-1549 Capture only Ethernet type EAPOL: · ether proto 0x888e Reject ethernet frames towards the Link Layer Discovery Protocol Multicast group: · not ether dst 01:80:c2:00:00:0e Capture only IP traffic - the shortest filter, but sometimes very useful to get rid of lower layer protocols like ARP and STP: · ip Capture only unicast traffic - useful to get r