{"id":1761,"date":"2020-03-11T22:26:39","date_gmt":"2020-03-11T14:26:39","guid":{"rendered":"http:\/\/www.eumz.com\/?p=1761"},"modified":"2020-03-11T22:26:39","modified_gmt":"2020-03-11T14:26:39","slug":"wireshark%e7%ae%80%e5%8d%95%e8%bf%87%e6%bb%a4%e8%af%ad%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.wxcn.com\/?p=1761","title":{"rendered":"WIRESHARK\u7b80\u5355\u8fc7\u6ee4\u8bed\u6cd5"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u8fde\u63a5\u7b26\uff1a<br>==(eq) \u7b49\u4e8e<br>!=(ne) \u4e0d\u7b49\u4e8e<br>&lt;(lt) \u5c0f\u4e8e<br>&gt;(gt) \u5927\u4e8e<br>&gt;=(ge) \u5927\u4e8e\u7b49\u4e8e<br>&lt;=(le) \u5c0f\u4e8e\u7b49\u4e8e<br>&amp;&amp;(and) \u4e0e<br>||(or) \u6216<br>!(not) \u975e<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fc7\u6ee4IP\u5730\u5740\uff1a<br>\u8fc7\u6ee410.251.251.251\u7684\u6570\u636e\u5305<br>ip.addr==10.251.251.251<br><br>\u8fc7\u6ee4\u6e90\u5730\u5740\u4e3a1.1.1.8\u7684\u6570\u636e\u5305<br>ip.src==10.251.251.251<br><br>\u8fc7\u6ee4\u6e90\u5730\u57401.1.1.8\u6216\u8005\u76ee\u7684\u5730\u57401.1.1.10\u7684\u6570\u636e\u5305<br>ip.src==1.1.1.8 or ip.dst==1.1.1.10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fc7\u6ee4\u7aef\u53e3\uff1a<br>\u8fc7\u6ee4tcp80\u7aef\u53e3\u7684\u6570\u636e\u5305<br>tcp.port eq 80\uff0c\u6216\u8005tcp.port == 80<br><br>\u8fc7\u6ee4\u76ee\u7684\u7aef\u53e3tcp80\u7684\u6570\u636e\u5305<br>tcp.dstport == 80<br><br>\u8fc7\u6ee4tcp\u7aef\u53e31000\u52302000\u4e4b\u95f4\u7684\u6570\u636e\u5305<br>tcp.port&gt;=1000 and tcp.port&lt;=2000<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fc7\u6ee4MAC\u5730\u5740\uff1a<br>\u8fc7\u6ee4\u76ee\u7684MAC11:22:33:44:55:66<br>eth.addr == 11:22:33:44:55:66<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fc7\u6ee4http\u534f\u8bae\u4e2d\u5e26host\u5b57\u6bb5\u7684\u6570\u636e\u5305<br>http.host<br>http.host==1.1.1.8<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fc7\u6ee4http\u4e2dpost\u5b57\u6bb5\u7684\u6570\u636e\u5305<br>http request method == POST<br>\u6ce8\u610f\u533a\u5206\u5927\u5c0f\u5199\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u8fde\u63a5\u7b26\uff1a==(eq) \u7b49\u4e8e!=(ne) \u4e0d\u7b49\u4e8e&lt;(lt) \u5c0f\u4e8e&gt;(gt) \u5927\u4e8e&gt;=(ge)  [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[330,453],"class_list":["post-1761","post","type-post","status-publish","format-standard","hentry","category-tech","tag-wireshark","tag-453"],"_links":{"self":[{"href":"https:\/\/www.wxcn.com\/index.php?rest_route=\/wp\/v2\/posts\/1761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wxcn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wxcn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wxcn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wxcn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1761"}],"version-history":[{"count":0,"href":"https:\/\/www.wxcn.com\/index.php?rest_route=\/wp\/v2\/posts\/1761\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wxcn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wxcn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wxcn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}