[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Masquerading problems: squeeze via lenny

Antonio Perez wrote:

> which both work on port 80, filter the destination port 80 and compare.
> hint: tcp.dstport==80

also you may add the dest IP or any other relevant factor to reduce noise:

for wget http://www.google.com :
	tcp.dstport==80 and ip.addr==

for http://www.livecdlist.com:
	tcp.dstport==80 and ip.addr==

Note: google.com site resolves to several addresses, so a /24 range will 
cover all of them.

Antonio Perez

Reply to: