I would like to create a display filter that will remove all sub-domains within a known domain. for example. I want to exclude all *.dropbox.com traffic like www.dropbox.com and snt-re4-8d.sjc.dropbox.com along with snt-re3-4b.sjc.dropbox.com and snt-re3-7b.sjc.dropbox.com, etc with one command not 4+. So far !(ip.host == www.dropbox.com) works but *.dropbox.com produces an isnt a valid syntax filter error. Thanks asked 07 Nov '14, 15:26  fa2lerror |
3 Answers:
I just tries
Regards Matthias answered 07 Nov '14, 23:09  mrEEde |
There's no way to do that. Wireshark doesn't have any code to get all the DNS records for a wildcard domain name and do a filter that compares an IP address field with all IP addresses in the records that match that domain name. answered 07 Nov '14, 18:59  Guy Harris ♦♦ |
Actually it’s a record in DNS zone that matches the request for nonexistent domain name. If you are having a personal domain along with email configured in it, can filter out the wildcards. However the process is multilevel and quite complex. For convenience you can see slipstick.com/outlook/rules/create-a-rule-with-wildcards/. The source describes all wildcard rules, hence I hope it will be helpful for you. answered 26 Feb '15, 02:29  karltucker |
