325
edits
Capture module: Difference between revisions
m
→Using expert filters to start captures
Remco.derooy (talk | contribs) |
Remco.derooy (talk | contribs) |
||
| Line 192: | Line 192: | ||
|- | |- | ||
|} | |} | ||
:will case insensitive match packets that contain the string(s) 'allegro' and/or 'http' anywhere in the payload. | |||
:NOTE: The use of regexp is CASE sensitive. You must use the (?i) modifier to enable case insensitive filtering. | |||
Of course the Allegro Network Multimeter regular expression (RegEx) capture filter, can also be used in combination with our other capture expressions. | Of course the Allegro Network Multimeter regular expression (RegEx) capture filter, can also be used in combination with our other capture expressions. | ||
| Line 203: | Line 203: | ||
|- | |- | ||
|} | |} | ||
:Will case sensitive match and capture <u>only DNS packets</u> containing the string(s) “allegro” and/or “analyzer. | |||
* The expression | * The expression | ||
| Line 211: | Line 211: | ||
|- | |- | ||
|} | |} | ||
:Will case sensitive match and capture all (except DNS) packets containing the string(s) “allegro” and/or “analyzer. | |||
<i>Whenever you are unsure about the outcome of RegEx based packet capturing, you can pre-test the outcome of your expressions on https://pythex.org/. | <i>Whenever you are unsure about the outcome of RegEx based packet capturing, you can pre-test the outcome of your expressions on https://pythex.org/. | ||
While pre-testing on https://pythex.org/, avoid using the “IGNORECASE” button. Instead use the (?i) modifier for constructing case insensitive expressions, as mentioned above. Python based expression examples and explanations you'll find on https://www.programiz.com/python-programming/regex</i> | While pre-testing on https://pythex.org/, avoid using the “IGNORECASE” button. Instead use the (?i) modifier for constructing case insensitive expressions, as mentioned above. | ||
Python based expression examples and explanations you'll find on https://www.programiz.com/python-programming/regex</i> | |||