This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

extract all HTTP requests whose User-Agent length is less than a limit

0

Wonder if it is possible to extract all HTTP requests whose User-Agent length is less than 10.

asked 07 Dec '15, 06:41

pktUser1001's gravatar image

pktUser1001
201●49●50●54
accept rate: 12%

One Answer:

0

The clean way to do that is by matching the parameter value to a regular expression:

http.user_agent matches "^.{1,9}$"

Translation: between the start of the string, ^, and the end of the string, $, there is a minimum of one and a maximum of 9 "any characters", represented by ..

answered 07 Dec '15, 06:58

sindy's gravatar image

sindy
6.0k●4●8●51
accept rate: 24%

edited 07 Dec '15, 21:38

Thanks @sindy for the quick reply. Did you mean to say http.user_agent and !http.user_agent[10]>0?

(07 Dec '15, 07:09) pktUser1001

Yes, I've just missed you've given the particular value of 10 in the question, so I!ve just fixed my answer yet another time.

(07 Dec '15, 07:10) sindy

It looks like this is a good workaround, but I feel user_agent[10] may index into unspecified memory, so this behavior may not be well defined. What do you think?

(07 Dec '15, 12:41) pktUser1001

That's why I wrote it was dirty. There is a safe method but I had problems to realize what should be selected and what not. I'll edit the answer accordingly in a second.

(07 Dec '15, 13:36) sindy

Thanks, a "dirty" solution is better than no solution -)

(07 Dec '15, 20:14) pktUser1001