So, if you want to see only non zero bytes packets with http content, you may use this setting: I’ll make this system public for tags submission/port submission, so interested users will be able to add necessary tags. Signatures and ports you may update with Shark Updater (included in Shark Reader), but I have too little time to manage all those resources. Traffic is tagged by content (signature) and port. Shark reader marks packets as RAW if it does not recognize it (currently it means it’s not tcp/udp packet).įor filters you can use any tag and any tag with – sign. pcap files are fine when i open them with Wireshark.Īt the bottom i see this: -NULL, what else i can use here and how it effects?įor Shark for Root parameters look at some examples/manuals about tcpdump.
Could someone tell about using different parameters or point me to some website where i could study these?(now i got the defaults)Īnd when i open Shark reader i see many “RAW Packet” but i cant get any information from them, just “Packet #number”.
0 kommentar(er)
