Re: Removing [TCP segment of a reassembled PDU] and HTTP Continuation or non-HTTP traffic

[Martin Visser <martinvisser99 () gmail com>]

For what it's worth a cleaner display filter to not idsplay packets which
are "TCP [TCP segment of a reassembled PDU]"  is

"!tcp.reassembled_in"

Regards, Martin

MartinVisser99 () gmail com


On Sat, Oct 3, 2009 at 2:41 PM, Domingo J. Ponce <djponce () prolexic com>wrote:

> Thanks let me put this to the test and I'll let you know.
>
>
> j.snelders wrote:
> > Hi Domingo,
> >
> > Does this capture filter help you:
> > -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] == 16)"
> >
> > $ tshark -i 2 -f "(len<=100) && (udp || tcp[13:1] == 2 || tcp[13:1] ==
> 16)"
> > -w test2.pcap
> >
> > Best regards
> > Joan
> >
> >
> > On Fri, 02 Oct 2009 08:05:19 -0400 Domingo J. Ponce wrote:
> >
> > > Hello Guys,
> > >
> > > I use Tshark for network monitoring and sniffing of malicious traffic at
> > >
> > > work and I am trying to figure out how I can get Tshark to stop showing
> >
> >
> > > packets that are TCP [TCP segment of a reassembled PDU] and HTTP
> > > Continuation or non-HTTP traffic.
> > >
> > > I only need this in Tshark and not Wireshark. I use tshark Live to view
> >
> >
> > > any incoming attacks (SYN Floods, ACK, Flood, UDP, Floods) and when I do
> > >
> > > see an attack sometimes my out put is flooded with [TCP segment of a
> > > reassembled PDU] and HTTP Continuation or non-HTTP traffic responses.
> > >
> > > Sincerely,
> > > --
> > >
> > >
> > > Domingo J. Ponce
> > >
> > > Prolexic Technologies
> > >
> > > SOC Engineer
> > >
> > > +1954-620-6002 ext 911
>
>
> --
>
>
> Domingo J. Ponce
>
> Prolexic Technologies
>
> SOC Engineer
>
> +1954-620-6002 ext 911
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe