Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got an application that is communicating with an Oracle database, it's logging is pretty crappy so the only way I can workout what SQL it is sending to our database is by packet sniffing for TNS.requests; I want to filter these packets by those that contain the name of particular ie on the existence of a paricular string in the packet. How can I do this?

Thanks.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Have you tried the "contains" or "matches" operators? For example,

tns.request and tns contains "Marshmallows"

or simply

frame matches "(?i)marshmallows"

The first example looks for TNS requests which contain the case-sensitive string "Marshmallows". The second example looks for "marshmallows" anywhere in any frame, ignoring case. ("contains" does simple string matching; "matches" lets you use PCRE modifiers).

share|improve this answer
    
Thanks, I thought it would be something simple, cheers that was exactly what I wanted to know. –  user62006 Dec 6 '10 at 14:56

There are several interpretations of your question:

  1. You're using WireShark and want to do more sophisticated filtering to better analyze the data. in that case, read the docs. You can also program filters in Lua, if you need extra expressive power.

  2. You want to filter those packets out; ie, an application-level firewall or NIDS. Check L7-filter for firewall/shaping, or Snort for NIDS (the latter can also use some Lua scripts, i think)

  3. You wan to capture packets to log, create statistics or any other automated task. check tcpdump / libpcap and/or my own libpcap binding for Lua.

share|improve this answer
    
Yeah I've read the docs, but I couldn't find what I was looking for. All I want to do is add a filter to find a strind in the raw packet data. I do a search on the TNS.request filtered data, but that just jumps through each packet where the string appears. Sorry, I thought that this would be a really bit of syntax. –  user62006 Nov 30 '10 at 18:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.