|
Advanced rules are the most powerful and flexible rules that allow
you to create complex filters using Boolean logic. Using advanced
rules requires a basic understanding of mathematics and logic, but
the rules syntax is rather easy to understand.
Overview
To add a new rule, you should enter an arbitrary name in the
Name
field, select the action (Capture/Ignore),
enter a
Formula
using the syntax described below, and click
Add/Edit.
Your new rule will be added to the list and become active
immediately. You can add as many rules as you wish, but only those
rules that have a checked box next to the rule name are active
currently. You can activate/deactivate rules by checking/unchecking
the corresponding boxes or completely delete selected rules using
the
Delete
button. If more than one rule is active, you can evaluate the
resulting combined rule by clicking
Evaluate.
Please note that multiple positive ("Capture") active rules are
combined using the logical OR operator, e.g. if you have three
active rules, RULE1, RULE2, and RULE3, the resulting rule is RULE1
OR RULE2 OR RULE3. If you also use negative ("Ignore") rules, those
will be added to the final expression using the logical AND
operator, because combining a negative rule as "OR" would be make
no sense.
You can use advanced rules in conjunction with the basic rules
described in the previous chapter. However, if you feel comfortable
with Boolean logic, it is a good idea to use advanced rules only,
as they offer much more flexibility. Basic rules are combined with
advanced rules using the logical AND operator.
Syntax Description
dir
– packet direction. Possible values are
in
(inbound),
out
(outbound), and
pass
(pass-through). This keyword is for compatibility with the
standard, non-wireless edition of CommView only. In CommView for
WiFi, there are no inbound or outbound packets, because your
adapter does not participate in data exchange and only passively
monitors pass-through packets.
etherproto
– Ethernet protocol, the 13th
and 14th
bytes of the packet. Acceptable values are numbers (e.g.
etherproto=0x0800
for IP) or common aliases (e.g.
etherproto=ARP,
which is equivalent to 0x0806).
ipproto
– IP protocol. Acceptable values are numbers (e.g.
ipproto!=0x06
for TCP) or commonly used aliases (e.g.
ipproto=UDP,
which is equivalent to 0x11).
smac
– source MAC address. Acceptable values are MAC addresses in hex
notation (e.g.
smac=00:00:21:0A:13:0F)
or user-defined aliases.
dmac
– destination MAC address.
sip
– source IP or IPv6 address. Acceptable values are IP addresses in
dotted notation (e.g.
sip=192.168.0.1),
IP addresses with wildcards (e.g.
sip!=*.*.*.255,
except for IPv6 addresses), network addresses with subnet
masks (e.g.
sip=192.168.0.4/255.255.255.240
or
sip=192.168.0.5/28),
IP ranges (e.g.
sip from 192.168.0.15 to 192.168.0.18
or
sip in 192.168.0.15 .. 192.168.0.18
), or user-defined aliases. Use of IPv6 addresses requires
Windows XP or higher and that the IPv6 stack be
installed.
dip
– destination IP address.
sport
– source port for TCP and UDP packets. Acceptable values are
numbers (e.g.
sport=80
for HTTP), ranges (e.g.
sport from 20 to 50
or
sport in 20..50
for any port number between 20 and 50) or the aliases defined by
your operating system (e.g.
sport=ftp,
which is equivalent to 21). For the list of aliases supported by
your OS click
View => Port Reference.
dport
– destination port for TCP and UDP packets.
flag
– TCP flag. Acceptable values are numbers (e.g.
0x18
for PSH ACK) or one or several of the following characters:
F
(FIN),
S
(SYN),
R
(RST),
P
(PSH),
A
(ACK), and
U
(URG), or the
has
keyword, which means that the flag contains a certain value. Usage
examples:
flag=0x18,
flag=SA,
flag has F.
size
– packet size. Acceptable values are numbers (e.g.
size=1514)
or ranges (e.g.
size
from 64 to 84
or
size in 64..84
for any size between 64 and 84).
str
– packet contents. Use this function to indicate that the packet
must contain a certain string. This function has three arguments:
string, position, and case sensitivity. The first argument is a
string, e.g.
'GET'.
The second argument is a number that indicates the string position
(offset) in the packet. The offset is zero-based, i.e. if you are
looking for the first byte in the packet, the offset value must
be
0.
If the offset is not important, use
–1.
The third argument indicates the case-sensitivity and can be
either
false
(case-insensitive) or
true
(case-sensitive). The second and third arguments are optional; if
omitted, the offset defaults to
–1
and the case-sensitivity defaults to
false.
Usage examples:
str('GET',-1,false),
str('GET',-1),
str ('GET').
hex
– packet contents. Use this function to indicate that the packet
must contain a certain hexadecimal byte pattern. This function has
two arguments: hex pattern and position. The first argument is a
hex value, e.g.
0x4500.
The second argument is a number that indicates the pattern position
(offset) in the packet. The offset is zero-based, i.e. if you are
looking for the first byte in the packet, the offset value must
be
0.
If the offset is not important, use
–1.
The second argument is optional; if omitted, the offset defaults
to
–1.
Usage examples:
hex(0x04500, 14)
,
hex(0x4500, 0x0E),
hex (0x010101).
bit
–
Packet contents. Use this function to determine if the specified
bit at the specified offset is set to 1, in which case the function
returns
true.
If the specified bit is set to 0 or the specified byte is beyond
the packet boundary, the function returns
false.
This function has two arguments: bit index and byte
position.
The first argument is the bit index in the byte; the allowed values
are 0-7. The index
is zero-based, i.e. if you're looking for the eighth bit in the
byte, the index value must be
7.
The second argument is a number that indicates the byte position
(offset) in the packet. The offset is zero-based, i.e. if you're
looking for the first byte in the packet, the offset value must
be
0.
Both arguments are mandatory. Usage examples:
bit(0, 14)
,
bit(5, 1).
ToDS, FromDS, MoreFrag, Retry, Power, MoreData, WEP, Order, Ftype,
FsubType, Duration, FragNum, SeqNum
- allow you to use 802.11 packet header fields in advanced
rules. The names of the operators fully correspond to the packet
header fields as described in the 802.11 standard specification.
The acceptable values for ToDS, FromDS, MoreFrag, Retry, Power,
MoreData, WEP, and Order are 0 or 1. For Ftype, FsubType, Duration,
FragNum, and SeqNum operators other numeric values are
acceptable.
Please refer to the 802.11 standard specification for the detailed
information about 802.11 packet headers fields and their
acceptable values.
The keywords described above can be used with the following
operators:
and
- Boolean conjunction.
or
- Boolean disjunction.
not
- Boolean negation.
=
- arithmetic equality.
!=
- arithmetic inequality.
<>
- same as above.
>
- arithmetic greater-than.
<
- arithmetic less-than.
( )
– parenthesis, control operator precedence rules.
All numbers can be in decimal or hexadecimal notation. If you want
to use the hexadecimal notation, the number must be preceded
by
0x,
i.e. you can use either
15
or
0x0F.
Examples
Below you will find a number of examples illustrating the rules
syntax. Each rule is followed by our comments about what the rule
does. The rules are shown in red. The comments are separated from
the actual rule by two slashes.
·(smac=00:00:21:0A:13:0E
or
smac=00:00:21:0A:13:0F)
and
etherproto=arp
// Captures ARP packets sent by two computers, 00:00:21:0A:13:0E
and 00:00:21:0A:13:0F.
·ipproto=udp
and
dport=137
// Captures UDP/IP packets sent to the port number 137.
·dport=25
and
str('RCPT
TO:', -1, true)
// Captures TCP/IP or UDP/IP packets that contain "'RCPT TO:" and
where the destination port is 25.
·not
(sport>110)
// Captures everything except the packets where the source port is
greater than 110.
·(sip=192.168.0.3
and
dip=192.168.0.15)
or
(sip=192.168.0.15
and
dip=192.168.0.3)
// Captures only the IP packets being sent between two machines,
192.168.0.3 and 192.168.0.15. All other packets are
discarded.
·((sip
from 192.168.0.3 to
192.168.0.7)
and
(dip
=
192.168.1.0/28))
and
(flag=PA)
and
(size
in 200..600)
// Captures TCP packets the size of which is between 200 and 600
bytes coming form the IP addresses in the 192.168.0.3 - 192.168.0.7
range, where destination IP address is in the
192.168.1.0/255.255.255.240 segment, and where the TCP flag is PSH
ACK.
·Hex(0x0203,
89)
and
(dir<>in)
// Captures the packets that contain 0x0203 at the offset 89, where
the packet direction is not inbound.
·not(ftype=0
and
fsubtype=8)
// Ignore management packets of the beacon type
·ftype=2
and
wep=1
// Capture encrypted data packets
·MoreFrag=0
and
FragNum=0
// Capture unfragmented packets
|
