Re: [Ethereal-users] http content capture filter

[Guy Harris <gharris@xxxxxxxxx>]

NOEL, ANDRE wrote:

> Is there any way to do a capture filter based on the HTTP data content ? 
>  I want to capture Every packet that contains  the word   CONNECT.

There's no general "string match" instruction in the BPF pseudo-machine 
used for capture filters, nor are there any backwards branches in the 
BPF pseudo-machines in various OS kernels (so that you can't load a 
pseudo-program that can loop infinitely), so there's no way to look for 
CONNECT at any arbitrary offset in the packet.

You can look for it at a *specific* offset in the packet, although it's 
not easy to construct the expression:

	http://home.insight.rr.com/procana/#Payload