Filters in wireshark

DisplayFilters

Wireshark uses display filters for general packet filtering while viewing and for its ColoringRules.

The basics and the syntax of the display filters are described in the User's Guide.

The master list of display filter protocol fields can be found in the display filter reference.

If you need a display filter for a specific protocol, have a look for it at the ProtocolReference.

Examples

Show only SMTP (port 25) and ICMP traffic:

•  tcp.port eq 25 or icmp

Show only traffic in the LAN (192.168.x.x), between workstations and servers -- no Internet:

• ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16

TCP buffer full -- Source is instructing Destination to stop sending data

•  tcp.window_size == 0 && tcp.flags.reset != 1

Filter on Windows -- Filter out noise, while watching Windows Client - DC exchanges

•  smb || nbns || dcerpc || nbss || dns

Sasser worm: --What sasser really did--

•   ls_ads.opnum==0x09

Match packets containing the (arbitrary) 3-byte sequence 0x81, 0x60, 0x03 at the beginning of the UDP payload, skipping the 8-byte UDP header. Note that the values for the byte sequence implicitly are in hexadecimal only. (Useful for matching homegrown packet protocols.)

•   udp[8:3]==81:60:03

The "slice" feature is also useful to filter on the vendor identifier part (OUI) of the MAC address, see the Ethernet page for details. Thus you may restrict the display to only packets from a specific device manufacturer. E.g. for DELL machines only:

•   eth.addr[0:3]==00:06:5B

It is also possible to search for characters appearing anywhere in a field or protocol by using the matches operator.

Match packets that contains the 3-byte sequence 0x81, 0x60, 0x03 anywhere in the UDP header or payload:

•   udp contains 81:60:03

Match packets where SIP To-header contains the string "a1762" anywhere in the header:

•   sip.To contains "a1762"

The matches operator makes it possible to search for text in string fields and byte sequences using a regular expression, using Perl regular expression syntax. Note: Wireshark needs to be built with libpcre in order to be able to use the matches operator.

Match HTTP requests where the last characters in the uri are the characters "gl=se":

•   http.request.uri matches "gl=se$"

Note: The $ character is a PCRE punctuation character that matches the end of a string, in this case the end of http.request.uri field.

Filter by a protocol ( e.g. SIP ) and filter out unwanted IPs:

  ip.src != xxx.xxx.xxx.xxx && ip.dst != xxx.xxx.xxx.xxx && sip

[ Feel free to contribute more ]

Gotchas

Some filter fields match against multiple protocol fields. For example, "ip.addr" matches against both the IP source and destination addresses in the IP header. The same is true for "tcp.port", "udp.port", "eth.addr", and others. It's important to note that

•  ip.addr == 10.43.54.65

  is equivalent to

   ip.src == 10.43.54.65 or ip.dst == 10.43.54.65

This can be counterintuitive in some cases. Suppose we want to filter out any traffic to or from 10.43.54.65. We might try the following:

•  ip.addr != 10.43.54.65

  which is equivalent to

   ip.src != 10.43.54.65 or ip.dst != 10.43.54.65

This translates to "pass all traffic except for traffic with a source IPv4 address of 10.43.54.65 and a destination IPv4 address of 10.43.54.65", which isn't what we wanted.

Instead we need to negate the expression, like so:

•  ! ( ip.addr == 10.43.54.65 )

  which is equivalent to

   ! (ip.src == 10.43.54.65 or ip.dst == 10.43.54.65)

This translates to "pass any traffic except with a source IPv4 address of 10.43.54.65 or a destination IPv4 address of 10.43.54.65", which is what we wanted.

http://wiki.wireshark.org/DisplayFilters

 

Forfiles

How to use Forfiles command in DOS:

http://technet.microsoft.com/en-us/library/cc753551.aspx

DOS - String Manipulation

Basic string manipulation in batch like you are used to from other programming languages.

http://www.dostips.com/DtTipsStringManipulation.php

Ericsson buys Fabrix Systems for $95M to help put TV on any screen

Who will guess ????????

The line between TV and mobile services is blurring, and in many cases that blur in between them is a cloud.
That’s the logic behind Ericsson’s planned US$95 billion acquisition of Fabrix Systems, which sells a cloud-based platform for delivering DVR (digital video recorder), video on demand and other services.

http://www.techhive.com/article/2682932/ericsson-buys-fabrix-systems-for-95m-to-help-put-tv-on-any-screen.html

TV Business has change again

After more than 14 years (in Last winter) Microsoft is out:

Ericsson closes acquisition of Microsoft Mediaroom

2013-09-05

Categories: Press Releases

Download:

• Mediaroom is the world's most deployed IPTV platform, serving almost 13 million consumer households
• Acquisition confirms Ericsson as a world leader for cutting edge TV-over-IP delivery with a combined market share of around 25%
• Deal represents a strategic addition to Ericsson's multi-screen offering

Ericsson (NASDAQ:ERIC) has today completed the acquisition of Microsoft's Mediaroom business and TV solution. Together with Ericsson's existing capability, the acquisition places the firm as the world's largest, by market share, and the most experienced provider of IPTV middleware technology and solutions.

As the most deployed IPTV platform, with a global market share of around 25%, Mediaroom-powered TV services are offered by nearly 60 of the world's leading operators, delivering services to almost 13 million households, and close to 24 million set top boxes, throughout the world.

http://www.ericsson.com/news/1727445

O que é o accrual - termo contabilistico?

Regime de competência (do inglês accrual-basis) é o que apropria (ou seja, considera ocorrido o fato gerador) receitas e despesas ao período de sua realização, independentemente do efetivo recebimento das receitas ou do pagamento das despesas. Sua principal vantagem é a possibilidade de previsão, ou seja, o futuro também passa a fazer parte da contabilidade da entidade.
Como exemplo podemos citar uma compra de mercadorias a prazo:
Se a compra ocorreu no mês de janeiro com pagamento em fevereiro, a despesa deverá constar nos registros de janeiro, embora o pagamento seja feito em fevereiro.
Contabilisticamente, em janeiro, processa-se a despesa e como contra-partida, cria-se uma obrigação em Contas a pagar. Em fevereiro, por ocasião do pagamento, deduz-se o valor pago de Contas a pagar e reduz-se o valor do caixa.
Existem ainda outros dois regimes contabilisticos: o de caixa (do inglês cash-basis) e o misto, sendo este último utilizado na contabilidade pública brasileira. O regime de caixa possui o inconveniente da falta de previsão do futuro e é mais usado com finalidade de gestão.

How NTP works?

Um artigo muito bem explicado..

http://www.ntp.br/NTP/MenuNTPNtp

Find em Linux

Aqui fica o remark:

find ./ -iname "*.xml"

How to get an TOP 10 for SQL in Oracle

You'll need to put your current query in subquery as below : SELECT * FROM ( SELECT DISTINCT APP_ID, NAME, STORAGE_GB, HISTORY_CREATED, TO_CHAR(HISTORY_DATE, 'DD.MM.YYYY') AS HISTORY_DATE FROM HISTORY WHERE STORAGE_GB IS NOT NULL AND APP_ID NOT IN (SELECT APP_ID FROM HISTORY WHERE TO_CHAR(HISTORY_DATE, 'DD.MM.YYYY') ='06.02.2009') ORDER BY STORAGE_GB DESC ) WHERE ROWNUM <= 10   Oracle applies rownum to the result after it has been returned. You need to filter the result after it has been returned, so a subquery is required. You can also use RANK() function to get Top-N results. For performance try using NOT EXISTS in place of NOT IN.

WORD 2010 - Como proceder à alteração de grandes blocos de texto de Uppercase para Lowercase e vice versa

Este artigo explica como fazer esta conversão de modo automático.

http://nerdsrealm.blogspot.pt/2010/09/how-to-convert-all-caps-to-lowercase.html

Learn to narrow your search criteria for better searches in Outlook

Lista de metodos para fazer searchs mais fáceis no Outlook.
Link original em:

http://office.microsoft.com/en-001/outlook-help/learn-to-narrow-your-search-criteria-for-better-searches-in-outlook-HA010238831.aspx


The following table shows examples of searches you might find useful. The search query syntax, available when the Instant Search (Instant Search: A Search feature that provides search results quickly with word highlighting as you type. The Instant Search pane is always available in Mail, Calendar, Contacts, Tasks, Notes, Folder List, and Journal.) feature is enabled, follows this basic form: keyword:your search criteria value.

For example, from:bobby
You can also use logical operators AND, NOT, OR, <, >, =, and so forth to refine your search, and these are noted in the table. Logical operators must be typed in uppercase letters.
Note The search query syntax is created automatically and displayed in the Instant Search box when you use the Query Builder described in the previous section.

Type this	To find this
bobby	Items containing bobby, BOBBY, BoBby, or any other combination of uppercase and lowercase letters. Instant Search is not case sensitive.
bobby moore	Items containing both bobby and moore, but not necessarily in that order.
bobby AND moore	Items containing both bobby and moore, but not necessarily in that order. Note that logical operators such as AND, NOT, and OR must be in uppercase letters.
bobby NOT moore	Items containing bobby, but not moore.
bobby OR moore	Items containing bobby, moore, or both.
"bobby moore"	Items containing the exact phrase bobby moore. Note the use of double quotes so that the search results match the exact phrase within the quotes.
from:"bobby moore"	Items sent from bobby moore. Note the use of double quotes so that the search results match the exact phrase within the quotes.
from:"bobby moore" about:”status report”	Items sent from bobby moore where status report appears in the subject line, body, and attachment contents. Note the use of double quotes so that the search results match the exact phrase within the quotes.
hasattachment:yes	Items that have attachments. You can also use hasattachment:true to get the same results.
attachments:presentation.pptx	Items that have attachments named presentation.pptx or if the attachment contains presentation.pptx within its contents.
subject:"bobby moore"	Items whose subject contains the phrase bobby moore.
subject:bobby moore	Items with bobby in the subject line and with moore anywhere else in the document.
cc:"bobby more"	Items in which the display name bobby moore is on the Cc line.
cc:bobbymoore@contoso.com	Items in which the e-mail address bobbymoore@contoso.com is on the Cc line.
bcc:bobby	Items in which bobby is on the Bcc line.
messagesize:<10 KB	Items whose size is less than 10 kilobytes. Note the use of the "less than" comparison operator (<).
messagesize:>5 MB	Items whose size is larger than 5 megabytes. Note the use of the "greater than" comparison operator (>).
received:=1/1/2006	Items that arrived on 1/1/2006. Note the use of the "equals" comparison operator (=).
received:yesterday	Items that arrived yesterday. Instant Search also recognizes the follow date values: Relative dates: For example, today, tomorrow, yesterday Multi-word relative dates: For example, this week, next month, last week, past month, coming year Days: Sunday, Monday ... Saturday Months: January, February ... December
received:last week	Items that arrived last week. Note that if you run this query again a month from now you will obtain different results because it is a time relative query.
due:last week	Items that are flagged for follow up a due date.
messagesize:tiny	Items whose size is less than 10 kilobytes
messagesize:small	Items whose size is between 10 and 25 kilobytes
messagesize:medium	Items whose size is between 25 and 100 kilobytes
messagesize:large	Items whose size is between 100 and 500 kilobytes
messagesize:verylarge	Items whose size is between 500 kilobytes and 1 megabyte
followupflag:follow up	Items that are flagged for follow up.
messagesize:enormous	Items whose size is larger than 5 megabytes
hasflag:true	Items that are flagged for follow up.
from:bobby (received:1/7/05 OR received:1/8/05)	Items from bobby that arrived on either 1/7/05 or 1/8/05. Note the use of parentheses to group the dates.
received:>=10/1/06 AND received:<=10/5/06	Items that arrived between 10/1/06 and 10/5/06.
received:>10/1/06 AND received:<10/5/06	Items that arrived after 10/1/06 but before 10/5/06.
sent: yesterday	Items that you sent yesterday.
to:bobby	Items that you sent to bobby when you are searching in the Sent Items folder.
read:no	Items that have not been read. You can also use read:false to get the same results.
subject:status received:May	Items received from anyone during the month of May (any year) where the subject contains status.
startdate:next week subject:status	Calendar items next week where the subject contains status.
is:recurring	Calendar items that are recurring.
organizer:bobby	Calendar items where bobby is the organizer.
category:business	Items that are categorized as business.
firstname:bobby	Contacts that contain bobby in the First Name field.
lastname:moore	Contacts that contain moore in the Last Name field.
nickname:bobby	Contacts that contain bobby in the Nickname field.
jobtitle:physician	Contacts that contain physician in the Job Title field.
pager:555-0100	Contacts that contain 555-0100 in the Pager field.
businessphone:555-0100	Contacts that contain 555-0100 in the Business Phone field.
homephone:555-0100	Contacts that contain 555-0100 in the Home Phone field.
mobilephone:555-0100	Contacts that contain 555-0100 in the Mobile Phone field.
carphone:555-0100	Contacts that contain 555-0100 in the Car Phone field.
businessfax:555-0100	Contacts that contain 555-0100 in the Business Fax field.
homefax:555-0100	Contacts that contain 555-0100 in the Home Fax field.
businessaddress:(4567 Main St., Buffalo, NY 98052)	Contacts that contain 4567 Main St., Buffalo, NY 98052 in the Business Address field. Note the use of parentheses to enclose the address.
homeaddress:(4567 Main St., Buffalo, NY 98052)	Contacts that contain 4567 Main St., Buffalo, NY 98052 in the Home Address field. Note the use of parentheses to enclose the address.
businesscity:buffalo	Contacts that contain buffalo in the Business City field.
businesspostalcode:98052	Contacts that contain 98052 in the Business Postal Code field.
street:(4567 Main St)	Contacts that contain 4567 Main St in the Business Address Street field. Note the use of parentheses to enclose the address.
homestreet:(4567 Main St)	Contacts that contain 4567 Main St in the Home Address Street field. Note the use of parentheses to enclose the address.
birthday:6/4/1960	Contacts that contain 6/4/1960 in the Birthday field.
webpage:www.contoso.com	Contacts that contain the URL www.contoso.com in the Web Page Address field.