Wireshark mailing list archives
Re: Yum install centos 5.2
From: Guy Harris <guy () alum mit edu>
Date: Sun, 11 Oct 2009 16:10:12 -0700
On Oct 11, 2009, at 3:01 PM, Mike Brandonisio wrote:
This is the output I'm getting 0.090293 74.xx.xx.xx -> 64.xx.xx.xx SMTP C: EHLO host22.example.com That is exactly what I'm looking for. How can I can narrow the filter only those that contain 'SMTP'?
"Contain 'SMTP'" in what sense? Port 25 traffic normally "contains SMTP" in the sense that the traffic going to or from TCP port 25 is almost always SMTP traffic (nothing absolutely *prevents* non-SMTP traffic to be sent on port 25, but it's not usually done. Or do you mean "only those that contain 'HELO' or 'EHLO'"? That's trickier, but it should be possible, even with a capture filter - you want TCP segments where the payload begins with "HELO" or "EHLO". If there are no TCP options, then tcp[20:4] = 0x48454c4f or tcp[20:4] = 0x45484c4f will match all segments beginning with HELO or EHLO, so tcp port 25 and src host 74.xx.xx.xx and (tcp[20:4] = 0x48454c4f or tcp[20:4] = 0x45484c4f) should work as a capture filter. If there are TCP options, it'd be a little more complicated, as "20" would have to be replaced by the length of the TCP header (it can be done, I'd just have to spend some more time figuring it out). One of these days I may look at adding some libpcap syntax to do string matching and matching on TCP/UDP payload contents. ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Re: Yum install centos 5.2, (continued)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Kevin Cullimore (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Guy Harris (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Guy Harris (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Guy Harris (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Guy Harris (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 12)
- Re: Yum install centos 5.2 Guy Harris (Oct 12)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 12)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 14)
- Re: Yum install centos 5.2 Jeffrey Walton (Oct 14)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 14)
- Re: Yum install centos 5.2 Mike Brandonisio (Oct 11)
- Re: Yum install centos 5.2 Guy Harris (Oct 11)