TRACE PARAMETERS: <name of trace file>
Opens the given trace file for subsequent work with it.
smtp_client.pcap
INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without
INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without
INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.
before it.
before it.
tcp
CLEARMASK PARAMETERS: no parameters
The mask of packet (the set of previously defined conditions) will be cleared. New mask will correspond to any packet. This command is usually contained in headers to make the mask correspond to all packets of given type (ex: TCP packets).
ethproto = ip
ip.proto = tcp
srcip 194.85.99.33
CHTRACE PARAMETERS: "{" <block of script> "}"
The given block of script may contain field's values definitions or command
PRINT
Displays the given message. Use symbol
in message to indicate that line feed must be performed.
. These definitions will be applied to every packet from trace file which corresponds the mask described before the command.
{
PRINTL
Analog of
PRINT
Displays the given message. Use symbol
in message to indicate that line feed must be performed.
command. Additionally performs the line feed.
'before:\n$fullpacket$\n'
dstip 88.210.60.143
dstport 25
ip.len IPlen
tcp.crc TCPcrc
ip.crc IPcrc
PRINT
Displays the given message. Use symbol
in message to indicate that line feed must be performed.
'$srcport$\n'
PRINTL
Analog of
PRINT
Displays the given message. Use symbol
in message to indicate that line feed must be performed.
command. Additionally performs the line feed.
'after:\n$fullpacket$\n'
}
// write