/*
Traces two kinds of packet: 1) any http packet, but not to mail.ru; 2) any http packet.
run like this:
anettest -d eth0 -r -f this_file.fws
*/

INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.

before it.

tcp

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

"http not to mail"
dstport = 80
dstip != www.mail.ru

SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

regime for packet filter test. See "samples/FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

"any http "
dstip = any

/*
Output
http not to mail : recieved 1839/1, rate 18, 1.26 kB/s (840.3 kB) (sdev 0)
any http : recieved 1954/1, rate 18, 1.26 kB/s (855.3 kB) (sdev 0)
*/