Packet Filtering. Catching the Cool Packets. 

1 2

• 2. BackCover

• 3. Packet Filtering-Catching the Cool Packets

• 4. Introduction: About This Pod

• 5. Chapter 1: Packet Filtering and Offsets

  Overview What Exactly is a Filter? Capture Filters v. Display Filters Filtering Overhead Filters are Based on Data Offsets

• 6. The Ethernet Header Offsets

  The Ethernet Header Offsets

• 7. The IP Header Offsets

  The IP Header Offsets

• 8. The TCP Header Offsets

  The TCP Header Offsets

• 9. The UDP Header Offsets

  The UDP Header Offsets

• 10. The Typical Data Offsets

  The Typical Data Offsets

• 11. Filters Ya Just Gotta Have

  Filters Ya Just Gotta Have

• 12. Chapter One Test

  Chapter One Test

• 13. Chapter 2: Address Filtering

  Overview

• 14. MAC (Media Access Control) Address Filtering

  MAC (Media Access Control) Address Filtering

• 15. IP Address Filtering

  IP Address Filtering

• 16. Try This

  Try This

• 17. IPX Address Filtering

  IPX Address Filtering

• 18. Chapter Two Test

  Chapter Two Test

• 19. Chapter 3: Protocol Filtering

  Using the Protocol ID Field

• 20. Protocol Filters the Easy Way

  Protocol Filters the Easy Way

• 21. My Favorite Protocol Filters

  My Favorite Protocol Filters

• 22. Protocol Filters the Super Easy Way

  Protocol Filters the Super Easy Way

• 23. Chapter Three Test

  Chapter Three Test

• 24. Chapter 4: Pattern Filtering

  What is a Pattern?

• 25. Data Formats

  Data Formats Hexadecimal Data Format Binary Data Format ASCII Data Format EBCDIC Data Format Decimal Data Format

• 26. Boolean Operands

  Boolean Operands Using the OR Operand Using the AND Operand Using the NOT Operand

• 27. Filtering on Source and Destination Ports

  Filtering on Source and Destination Ports

• 28. Filtering on ICMP Packet Types

  Filtering on ICMP Packet Types

• 29. Filtering on TCP Flags

  Filtering on TCP Flags

• 30. Filtering on the TCP Handshake Process

  Filtering on the TCP Handshake Process

• 31. Filtering on FTP Commands

  Filtering on FTP Commands

• 32. Filtering on IP Fragment Fields

  Filtering on IP Fragment Fields

• 33. Filtering on a Variable Length Subnet Address (Another Binary Filter)

  Filtering on a Variable Length Subnet Address (Another Binary Filter)

• 34. Filtering on Stinkin Peer-to- Peer Application Commands

  Filtering on Stinkin Peer-to- Peer Application Commands Filtering Out Gnutella Traffic

• 35. Chapter Four Test

  Chapter Four Test

• 36. Appendix A: Answers to Chapter Tests

  Chapter One Answers

• 37. Chapter Two Answers

  Chapter Two Answers

• 38. Chapter Three Answers

  Chapter Three Answers

• 39. Chapter Four Answers

  Chapter Four Answers

• 40. Appendix B: Hex-Decimal-Binary Conversion Chart

• 41. Appendix C: Importing and Exporting Sniffer Filters

• 42. Appendix D: Importing and Exporting EtherPeek Filters

• 43. Index

  Numerics

• 44. Index_A

  A

• 45. Index_B

  B

• 46. Index_C

  C

• 47. Index_D

  D

• 48. Index_E

  E

• 49. Index_F

  F

• 50. Index_G

  G

1 2