Network Analysis Using Wireshark 2 Cookbook - Second Edition

How it works...

The general structure of an offset filter is:

proto [Offset in bytes from the start of the header : Number of bytes to check] 

Common examples for string matching filters are:

• For filtering destination TCP ports between 50 and 100, configure (tcp[2:2] > 50 and tcp[2:2] < 100). Here we count two bytes from the beginning of the TCP header, and check the next two bytes are lower than 100 and higher than 50:

• For checking a TCP window size smaller than 8192, configure tcp[14:2] < 8192. Here we count two bytes from the beginning of the TCP header, and check the next two bytes (the window size) are less than 8192:

• For filtering ...