[Martin Visser <martinvisser99@xxxxxxxxx>]

For what it's worth a cleaner display filter to not idsplay packets which are "TCP [TCP segment of a reassembled PDU]"  is 

"!tcp.reassembled_in"

Regards, Martin

MartinVisser99@xxxxxxxxx

On Sat, Oct 3, 2009 at 2:41 PM, Domingo J. Ponce <djponce@xxxxxxxxxxxx> wrote:

Thanks let me put this to the test and I'll let you know.

j.snelders wrote:
> Hi Domingo,
>
> Does this capture filter help you:
> -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
>
> $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
> -w test2.pcap
>
> Best regards
> Joan
>
>
> On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
>
>> Hello Guys,
>>
>> I use Tshark for network monitoring and sniffing of malicious traffic at
>>
>> work and I am trying to figure out how I can get Tshark to stop showing
>>
>
>
>> packets that are TCP [TCP segment of a reassembled PDU] and HTTP
>> Continuation or non-HTTP traffic.
>>
>> I only need this in Tshark and not Wireshark. I use tshark Live to view
>>
>
>
>> any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
>>
>> see an attack sometimes my out put is flooded with [TCP segment of a
>> reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
>>
>> Sincerely,
>> --
>>
>>
>> Domingo J. Ponce
>>
>> Prolexic Technologies
>>
>> SOC Engineer
>>
>> +1954-620-6002 ext 911
>>
>
>
>
>
>
>


--


Domingo J. Ponce

Prolexic Technologies

SOC Engineer

+1954-620-6002 ext 911

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe