For When You Can't Have The Real Thing
[ start | index | login ]
start > tcpdump > jesus filters

jesus filters

Created by Administrator. Last edited by Administrator, 14 years and 288 days ago. Viewed 1,585 times. #2
[diff] [history] [edit] [rdf]
When examining a capture of some malware trying to spread, often times it will SYN several hundred machines without getting a reply. Trolling through these can be a pain. But by using tethereal, you can make what I call "Jesus" pcaps (no SYN's). To make it complete, I also filter RST's like so:

tethereal -r infile.pcap -w outfile -R "tcp.flags.syn==0 && tcp.flags.reset==0"

no comments | post comment
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.

Useful: | Copyright 2000-2002 Matthias L. Jugel and Stephan J. Schmidt