WireSharp语法过滤器

爱被打了一巴掌 2022-05-09 01:40 46阅读 0赞

# WireSharp语法过滤器 #

<table> 
 <thead> 
  <tr> 
   <th>介绍</th> 
   <th>语法</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>不管端口是来源还是目标</td> 
   <td>tcp.port eq 80</td> 
  </tr> 
  <tr> 
   <td>过滤来源是某个ip</td> 
   <td>ip.src eq 192.168.60.122</td> 
  </tr> 
  <tr> 
   <td>过滤目标ip</td> 
   <td>ip.dst eq 192.168.1.107</td> 
  </tr> 
  <tr> 
   <td>不区分是源还是目标</td> 
   <td>ip.dst eq 192.168.1.107</td> 
  </tr> 
  <tr> 
   <td>tcp的目标端口</td> 
   <td>tcp.dstport == 80</td> 
  </tr> 
  <tr> 
   <td>端口范围过滤</td> 
   <td>tcp.port &gt;= 1 and tcp.port &lt;= 80</td> 
  </tr> 
  <tr> 
   <td>过滤目标mac</td> 
   <td>eth.dst == A0:00:00:04:C5:84</td> 
  </tr> 
  <tr> 
   <td>过滤来源mac</td> 
   <td>eth.src eq A0:00:00:04:C5:84</td> 
  </tr> 
  <tr> 
   <td>等于</td> 
   <td>eq</td> 
  </tr> 
  <tr> 
   <td>大于</td> 
   <td>gt</td> 
  </tr> 
  <tr> 
   <td>大于等于</td> 
   <td>ge</td> 
  </tr> 
  <tr> 
   <td>不等</td> 
   <td>ne</td> 
  </tr> 
  <tr> 
   <td>包长过滤</td> 
   <td>udp.length == 26</td> 
  </tr> 
  <tr> 
   <td>tcp包长度</td> 
   <td>tcp.len &gt;= 7</td> 
  </tr> 
  <tr> 
   <td>数据包长度</td> 
   <td>frame.len == 119</td> 
  </tr> 
  <tr> 
   <td>http请求方式</td> 
   <td>http.request.method == “GET”</td> 
  </tr> 
  <tr> 
   <td>http的uri</td> 
   <td>http.request.uri == “/img/logo-edu.gif”</td> 
  </tr> 
  <tr> 
   <td>get包</td> 
   <td>http.request.method == “GET” &amp;&amp; http contains "User-Agent: "</td> 
  </tr> 
  <tr> 
   <td>post包</td> 
   <td>http.request.method == “POST” &amp;&amp; http contains "User-Agent: "</td> 
  </tr> 
  <tr> 
   <td>响应包</td> 
   <td>http contains “HTTP/1.1 200 OK” &amp;&amp; http contains "Content-Type: "</td> 
  </tr> 
 </tbody> 
</table>