how to filter by data using BPF

Question

I am trying to filter a pcap file using bpf syntax. I need it to return only GET requests from HTTP that contains a certain word in the GET request, is it possible to do it? I managed to get the GET requests from HTTP but I can't find how to filter by the data of the packet.

Answer 1

What you've been asked to do is tricky, difficult, and impractical unless Wireshark or TCPDump do not have a protocol parser for some weird protocol that you are using.

A way to grab GET requests using BPF only would be as follows:

 dst port 80 and tcp[(tcp[12]>>2):4]=0x47455420

The reason it must be done in this way is that you must account for the possibility of changing TCP options and, as a result, changing locations for where the data offset begins. This figures out where the data starts and examines the first four bytes for the string "GET ".

You may also note that I am taking a shortcut for the TCP data offset value in byte 12. It would be better practice to do this:

 (tcp[12]>>4)*4

or this:

 (tcp[12]&0xf0 >> 2)

This would account for any bits in the reserved lower nibble being enabled.