# This file is automatically generated, DO NOT MODIFY.
"TRUE","TLS//TLS","tls","Show me the TLS packets"
"TRUE","TLS//InstaTLSstream","(tls)&&tcp.stream == ${tcp.stream}","Show me the TLS conversation this packet belongs to"
"TRUE","TLS//TLS Alerts","tls.alert_message","Show me the TLS Alert Messages"
"TRUE","TLS//TLS Handshake","tls.record.content_type in {22 20}","Show me the TLS Handshake messages"
"TRUE","TLS//TLS < 1.2","tls.handshake.type in {1 2} and tls.handshake.version in {0x0100 0x0200 0x0300 0x0301 0x0302}","Versions SSL 1.0 - 3.0 or TLS 1.0 or 1.1"
"TRUE","TLS//Client|Server Hello","tls.handshake.type in {1 2}","Show me the Client/Server Hellos"
"TRUE","TLS//Client//Client Hello","tls.handshake.type == 1","Show me the Client Hellos"
"TRUE","TLS//Client//Client SSL TLS 1.0 1.1","tls.handshake.version in {0x0100 0x0200 0x0300 0x0301 0x0302} and tls.handshake.type == 1",""
"TRUE","TLS//Client//Client TLSv1.2","tls.handshake.version == 0x0303 and not tls.handshake.extensions.supported_version and tls.handshake.type == 1",""
"TRUE","TLS//Client//Client TLSv1.3","tls.handshake.extensions.supported_version and tls.handshake.type == 1",""
"TRUE","TLS//Server//Server Hello","tls.handshake.type == 2","Show me the Server Hellos"
"TRUE","TLS//Server//Server SSL TLS 1.0 1.1","tls.handshake.version in {0x0100 0x0200 0x0300 0x0301 0x0302} and tls.handshake.type == 2",""
"TRUE","TLS//Server//Server TLSv1.2","tls.handshake.version == 0x0303 and not tls.handshake.extensions.supported_version and tls.handshake.type == 2",""
"TRUE","TLS//Server//Server TLSv1.3","tls.handshake.extensions.supported_version and tls.handshake.type == 2",""
"TRUE","TCP//TCP","tcp","Show me just the TCP packets"
"TRUE","TCP//InstaTCPstream","tcp.stream == ${tcp.stream}","Instantly give me the TCP Stream for the packet I am on"
"TRUE","TCP//T.A.F.","tcp.analysis.flags","TCP Analysis Flags - TCP Issues?"
"TRUE","TCP//SYNorSYNACK","tcp.flags.syn == 1","Just SYN and/or SYN-ACK"
"TRUE","TCP//SYN-NoSACK","(tcp.flags.syn == 1) && !(tcp.options.sack_perm == 04:02)","SYN Packets with No SACK"
"TRUE","TCP//SYNonly","tcp.flags == 02","Just SYN Packets"
"TRUE","DNS//DNS All","dns","DNS Traffic: All DNS Traffic"
"TRUE","DNS//DNS Query","dns.flags.response == 0","DNS Traffic: DNS Queries"
"TRUE","DNS//DNS Responses","dns.flags.response == 1","DNS Traffic: DNS Responses"
"TRUE","Possible Std Web Traffic","tcp.port in {80 8080 8088 443 9333 8443}","Show me the possible standard Web Traffic"
"TRUE","HTTP//HTTP Requests","http.request.method",""
"TRUE","HTTP//HTTP Specific User Agent","http.user_agent matches \x22iphone\x22",""
"TRUE","HTTP//HTTP GETs for Graphic Files","http.request.uri matches \x22gif|jpg|ico|bmp|jpeg|png\x22",""
"TRUE","HTTP//HTTP Error Response","http.response.code ge 400",""
"TRUE","HTTP//HTTP Redirects | Not-Modifieds","http.response.code ge 300 and http.response.code le 399",""
