Re: Removing [TCP segment of a reassembled PDU]and HTTP Continuation or non-HTTP traffic

["Sake Blok" <sake () euronet nl>]

That was my idea to, but unfortunately that does not work in tshark, as this field can only be set on a second pass 
through the packets (or random access to a specific packet) and tshark is (still) a one-pass analyser...

... and the O.P. wanted to monitor things with tshark.

Cheers,


Sake

  ----- Original Message ----- 
  From: Martin Visser 
  To: djponce () prolexic com ; Community support list for Wireshark 
  Sent: Saturday, October 03, 2009 10:11 AM
  Subject: Re: [Wireshark-users] Removing [TCP segment of a reassembled PDU]and HTTP Continuation or non-HTTP traffic


  For what it's worth a cleaner display filter to not idsplay packets which are "TCP [TCP segment of a reassembled 
PDU]"  is 

  "!tcp.reassembled_in"

  Regards, Martin

  MartinVisser99 () gmail com



  On Sat, Oct 3, 2009 at 2:41 PM, Domingo J. Ponce <djponce () prolexic com> wrote:

    Thanks let me put this to the test and I'll let you know.



    j.snelders wrote:
    > Hi Domingo,
    >
    > Does this capture filter help you:
    > -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
    >
    > $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
    > -w test2.pcap
    >
    > Best regards
    > Joan
    >
    >
    > On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
    >
    >> Hello Guys,
    >>
    >> I use Tshark for network monitoring and sniffing of malicious traffic at
    >>
    >> work and I am trying to figure out how I can get Tshark to stop showing
    >>
    >
    >
    >> packets that are TCP [TCP segment of a reassembled PDU] and HTTP
    >> Continuation or non-HTTP traffic.
    >>
    >> I only need this in Tshark and not Wireshark. I use tshark Live to view
    >>
    >
    >
    >> any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
    >>
    >> see an attack sometimes my out put is flooded with [TCP segment of a
    >> reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
    >>
    >> Sincerely,
    >> --
    >>
    >>
    >> Domingo J. Ponce
    >>
    >> Prolexic Technologies
    >>
    >> SOC Engineer
    >>
    >> +1954-620-6002 ext 911
    >>
    >
    >
    >
    >
    >
    >


    --


    Domingo J. Ponce

    Prolexic Technologies

    SOC Engineer

    +1954-620-6002 ext 911

    ___________________________________________________________________________
    Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
    Archives:    http://www.wireshark.org/lists/wireshark-users
    Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
                mailto:wireshark-users-request () wireshark org?subject=unsubscribe





------------------------------------------------------------------------------


  ___________________________________________________________________________
  Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
  Archives:    http://www.wireshark.org/lists/wireshark-users
  Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
               mailto:wireshark-users-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe