locked
need a "display filter" to find http packet which contains a specific word RRS feed

  • Question

  • hi friends

    in my test lab, i have deployed a web server.

    in default website folder (wwwroot) i have a text file named myfile.txt within which i have written some words, for example the word "computer".

    i started capturing traffic via Microsoft network monitor

    now via my client's browser, i browse this address   http://myserver/myfile.txt & my text file contents are shown within IE.

    now i need a display filter in Microsoft network monitor which find this packet for me ( i meani need to find the single http packet which contains the word "computer".

    i spent a lot of times but it didn't result.

    any help please?

    thanks in advance



    • Edited by john.s2011 Saturday, September 13, 2014 6:19 PM
    Saturday, September 13, 2014 9:05 AM

Answers

  • You can use the ContainsBin plugin and there's an example in the library under Search Frame.  For example the following looks for the word FONT.

    ContainsBin(FrameData, ASCII, "FONT")

    Also, just to let you know, we released Message Analyzer (http://blogs.technet.com/MessageAnalyzer), which also has this capability and a lot of other things that might help, such as regex expressions.

    Paul

    • Marked as answer by Paul E Long Tuesday, October 28, 2014 1:53 PM
    Tuesday, September 23, 2014 3:13 PM