Loading...
2025 © Ty Qualters. Built with .
2025 © Ty Qualters. Built with .
(Some content generated by ChatGPT)
| Function | Description | Example Usage | Notes |
|---|---|---|---|
lower() | Converts all characters in a string to lowercase for comparison. | lower(dns.qry.name) == "example.com" | Useful for case-insensitive matching. |
upper() | Converts all characters in a string to uppercase for comparison. | upper(http.host) == "EXAMPLE.COM" | Useful when hostnames/strings vary in case. |
match | Matches a string against a regular expression (regex). | http.host matches ".*example.*" | Case-sensitive by default; use (?i) for case-insensitive regex. |
string() | Converts a field into a string representation for comparison. | string(frame.number) contains "10" | Often used to treat numeric fields as text. |
contains | Checks if a string contains the specified substring (case-sensitive match). | http.user_agent contains "Mozilla" | Partial substring matching. |
ip.addr == <address>eth.addr == <address>tcp.flags == 2
tcp.flags.syn == 1tcp.flags == 16
tcp.flags.ack == 1tcp.flags == 18
(tcp.flags.syn == 1) and (tcp.flags.ack == 1)tcp.flags == 4
tcp.flags.reset == 1tcp.flags == 20
(tcp.flags.reset == 1) and (tcp.flags.ack == 1)tcp.flags == 1
tcp.flags.fin == 1arp.opcode == 1arp.opcode == 2arp.dst.hw_mac == 00:00:00:00:00:00arp.duplicate-address-detected or arp.duplicate-address-frame((arp) && (arp.opcode == 1)) && (arp.src.hw_mac == target-mac-address)dns.qry.name.len > 15 and !mdnsdata.len > 64 and icmptls.handshake.type == 1tls.handshake.type == 2ssdp(http.request or tls.handshake.type == 1) and !(ssdp) (http.request or tls.handshake.type == 2) and !(ssdp)