I have an application and a wireshark dump and need to filter packets in a way that only packets matching a certain pattern make it through. The data changes so I guess this is also the reason why the header and udp checksum changes. The data matches some kind of pattern i.e. the data from bytes 42-49 with increasing packet number looks like

0000000000000000 ... 0000000000000009 then 000000000000000a ... 000000000000000f then 0000000000000010 ... 0000000000000019 then 000000000000001a ... 000000000000001f
and so on. It seems to be some kind of ACK traffic / packet counter and certainly shows a pattern. But how could I filter based on that? Packets which don't match this pattern should be dropped. At the minimum I'd like to filter based on bytes 42-47 which never seem to change. But getting the pattern matching for bytes 48-49 would be ideal. The ASCII view does not show anything useful so filtering based on a string probably wont work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.