filter - Howto - 在 sharppcap 中设置过滤器？

Question

我正在使用Sharppcap库并尝试设置过滤器。我的目标是设置一个过滤器，它只添加来自一个 ip 地址的数据包，而不是任何 ip 和 tcp 数据包的全部数据。我试过whireshark符号...

device = CaptureDeviceList.Instance[itemIndex];
device.Open();
device.Filter = "ip.src=10.0.0.1 and tcp"; // doesn't work - only "ip and tcp" works

有人知道如何为这个库配置过滤器吗？:-)

多谢 ：-）

最好的问候

Answer 1

SharpPcap is a frontend for libpcap/winpcap so any filter you use has to be in a format that libpcap/winpcap understand. At this time no additional processing is performed by SharpPcap.

I believe the same filter syntax is used across libpcap/winpcap/tcpdump and wireshark.

Try something like:

"tcp and host 172.18.5.4" From here

Chris

SharpPcap author

Answer 2

尝试这个：

string mac = "00-AA-00-AA-00-AA";
string filter =String.Format("((tcp and ip) or udp) and ether src host {0}", mac);