Ethereal-users: Re: [Ethereal-users] searching for pattern in packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 8 May 2003 11:43:05 -0700
On Thu, May 08, 2003 at 09:22:46PM +0800, darren wrote:
> Hi all, 
> 
> Thanx for all your suggestions.
> 
> I have tried Martin's solution of the 'frame ' option, and found 9it to
> be very simple to use. However, it can be quite time consuming and may
> drop packets during a live capture > 15Mbps.

Your original message spoke of "capture files", which implies that
you're not doing this with a live capture.

For filtering a live capture, libpcap supports a similar filtering
mechanism, albeit not so convenient to use:

	% man tcpdump

		...

		expression
		      selects  which  packets  will  be  dumped.   If  no
		      expression is given, all packets on the net will be
		      dumped.	Otherwise, only packets for which expres-
		      sion is `true' will be dumped.

		      The expression consists of one or more  primitives.
		      Primitives  usually  consist of an id (name or num-
		      ber) preceded by one or more qualifiers.	There are
		      three different kinds of qualifier:

				...


		      In addition to the above, there  are  some  special
		      `primitive' keywords that don't follow the pattern:
		      gateway, broadcast, less,  greater  and  arithmetic
		      expressions.  All of these are described below.

		      More  complex  filter  expressions  are built up by
		      using the words and, or and not to  combine  primi-
		      tives.   E.g.,  `host  foo and not port ftp and not
		      port ftp-data'.  To save typing,	identical  quali-
		      fier lists can be omitted.  E.g., `tcp dst port ftp
		      or ftp-data or domain' is exactly the same as  `tcp
		      dst  port  ftp  or tcp dst port ftp-data or tcp dst
		      port domain'.

		      Allowable primitives are:

				...
		      expr relop expr
			     True if the relation holds, where	relop  is
			     one  of  >, <, >=, <=, =, !=, and expr is an
			     arithmetic expression  composed  of  integer
			     constants	(expressed in standard C syntax),
			     the normal binary operators [+, -, *, /,  &,
			     |],  a  length  operator, and special packet
			     data accessors.  To access data  inside  the
			     packet, use the following syntax:
				  proto [ expr : size ]
			     Proto  is one of ether, fddi, ip, arp, rarp,
			     tcp, udp, or icmp, and indicates the  proto-
			     col layer for the index operation.  The byte
			     offset, relative to the  indicated  protocol
			     layer,  is  given by expr.  Size is optional
			     and indicates the number  of  bytes  in  the
			     field  of	interest;  it  can be either one,
			     two, or four,  and  defaults  to  one.   The
			     length  operator,	indicated  by the keyword
			     len, gives the length of the packet.

			     For example, `ether[0] & 1 != 0' catches all
			     multicast	traffic.  The expression `ip[0] &
			     0xf  !=  5'  catches  all	IP  packets  with
			     options.  The expression `ip[6:2] & 0x1fff =
			     0' catches only unfragmented  datagrams  and
			     frag  zero  of  fragmented  datagrams.  This
			     check is implicitly applied to the  tcp  and
			     udp  index operations.  For instance, tcp[0]
			     always means  the	first  byte  of  the  TCP
			     header, and never means the first byte of an
			     intervening fragment.

		      Primitives may be combined using:

			     A	parenthesized  group  of  primitives  and
			     operators	(parentheses  are  special to the
			     Shell and must be escaped).

			     Negation (`!' or `not').

			     Concatenation (`&&' or `and').

			     Alternation (`||' or `or').

		      Negation has highest precedence.	 Alternation  and
		      concatenation  have  equal precedence and associate
		      left to right.  Note that explicit and tokens,  not
		      juxtaposition,  are now required for concatenation.

Note that "ether" and "fddi", in the "proto" field, will work for any
link layer - they just mean "relative to the beginning of the frame.

Note that those expressions can only compare 1, 2, or 4-byte quantities.