按域过滤

Question

我想通过他们的域过滤我的pcap文件.我的意思是,我希望看到网站上的数据包以".com",".org"或".net"结尾.

我试过:dns包含"com",ip.src_host == com,ip.src_host == com,http包含"com".他们都没有正常工作.

Answer 1

假设它是http网站流量,试试吧 http.host contains ".com"

更好的是,试试吧 http.host matches "\.com$"

因为他们在网络主机上搜索,所以都不会要求DNS解析.

来自http://wiki.wireshark.org/DisplayFilters

The matches operator makes it possible to search for text in string fields 
and byte sequences using a regular expression, using Perl regular expression 
syntax. Note: Wireshark needs to be built with libpcre in order to be able to 
use the matches operator.