Re: TCP Dump Filters

From: Matt Bing (mbing@nfr.net)
Date: 12/21/01 

Date: Fri, 21 Dec 2001 14:20:15 -0500
From: Matt Bing <mbing@nfr.net>
To: focus-ids@securityfocus.com

Derek Walker said:
> TCP dump can be given arguments as to how much of each packet to capture.
> With a snaplen of 1500 for instance, you will always capture pretty much
> the whole packet.

While this is true, I think the original poster was refering to writing
pattern matching syntaxes with tcpdump. tcpdump's BPF compiler (actually
libpcap's) is fairly limited and is mostly used for dealing with packet
headers, ie: "tcp[13] & 3 != 0".

The full BPF syntax itself is not useful for advanced pattern matching (think
regex), as all of this is done in the kernel with an assembly-like syntax.
See the bpf manpage for more info.

For more advanced filtering, use a program that grabs all packets (or at
least those you might be interested in) and does more intelligent filtering
in user-space. ngrep is a good example:

http://www.packetfactory.net/projects/ngrep/ 

-- 
Matt Bing
NFR Security
Rapid Response Team

Relevant Pages

  • IP protocol checksum errors
    ... Frame 3484 ... Time delta from previous packet: ... Capture Length: 254 bytes ... Fragment offset: 0 ...
    (comp.os.linux.embedded)
  • RE: Snort + (OpenBSD or Linux)
    ... Snort + (OpenBSD or Linux) ... >on the same packet. ... Regarding OpenBSD vs. Linux packet capture performance (this is a really old ...
    (Focus-IDS)
  • [TOOL] WinPcap, the Free Packet Capture Architecture for Windows
    ... the Free Packet Capture Architecture for Windows ...
    (Securiteam)
  • Re: How to go about developing a TCP Packet Filter
    ... You can modify and capture packets in LSP's, TDI filters and NDIS IM ... thus you don't know that there was an attempt to send packet. ... Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/ ...
    (microsoft.public.win32.programmer.kernel)
  • Re: DHCP issue switching scopes
    ... Here is a text file dump of a discover/offer packet pair ... I can send the entire capture file ... Time since reference or first frame: ... User Datagram Protocol, Src Port: bootps, Dst Port: ...
    (microsoft.public.windows.server.networking)