@TOC

查詢tcp

tcp

查詢tcp握手請求的代碼

tcp.flags.ack == 0

確定tcp握手成功的代碼

tcp.flags.ack == 1

確定tcp連接請求的代碼

tcp.flags.ack == 0 and tcp.flags.syn == 1

3次握手后確定發送成功的查詢

tcp.flags.fin == 1

查詢某IP對外發送的數據

ip.src_host == 192.168.73.134

查詢某IP向某IP發送的數據

ip.src_host == 192.168.73.134 and ip.dst_host == 36.103.205.147
(ip.src_host == 192.168.73.134 and ip.dst_host == 36.103.205.147) or ( ip.src_host == 36.103.205.147 and ip.dst_host == 192.168.73.134)