Changes between Version 3 and Version 4 of FilterExpressions


Ignore:
Timestamp:
02/03/12 04:26:50 (10 years ago)
Author:
Dorie
Comment:

Inteilglecne and simplicity - easy to understand how you think.

Legend:

Unmodified
Added
Removed
Modified
  • FilterExpressions

    v3 v4  
    1 == Broadcast IP packets that didn't use ethernet broadcast ==
    2 {{{ ether[0] & 1 == 0 and ip[16] >= 224 }}}
    3 == Non ICMP Echo-Request/Echo-Reply ICMP packets ==
    4 {{{'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' }}}
    5 == TCP SYN packets ==
    6 {{{'tcp[13] & 2 == 2'}}}[[BR]]
    7 {{{'tcp[13] == 2'}}}[BR]
    8 {{{'tcp[tcpflags] & tcp-syn != 0}}}[[BR]]
    9 == DNS Related ==
    10 === Queries ===
    11 {{{'port 53 and udp[10]&0x80==0x00'}}}
    12 === Responses ===
    13 {{{'port 53 and udp[10]&0x80!=0x00'}}}
    14 === Successful replies (RCODE=!NoError)) ===
    15 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==0'}}}
    16 === Format Error (RCODE=!FormErr) ===
    17 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==1'}}}
    18 === Server failure (RCODE=!ServFail) ===
    19 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==2'}}}
    20 === Name Error (RCODE=NXDOMAIN) ===
    21 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==3'}}}
    22 === Not implemented (RCODE=!NotImp) ===
    23 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==4'}}}
    24 === Refused (RCODE=Refused) ===
    25 {{{'port 53 and udp[10]&0x80!=0 and udp[11]&15==5'}}}
    26 === Truncated reply (requiring a resend via TCP) ===
    27 {{{'port 53 and udp[10]&0x02!=0'}}}
     1Inteilglecne and simplicity - easy to understand how you think.