Wireshark filter packet contains

Record a function of wireshark: Filter contains of a packet
Syntax:
[Protocol] contains [hex|"STRING"]

For example:
1. Filter packet which has hex 0xea in contains:
tcp contains ea

2. Filter packet which has string "test" in contains:
http contains "test"

Convert Multicast IPv4 Address to MAC address

There is a mapping between Multicast IP address and MAC address. The first three bytes of Multicast MAC address are always 01:00:5e, the last three bytes are filled from Multicast IP-form.
We drop the highest nine bits of IP address and convert to MAC address. And this number will become Multicast MAC address.

For example, IP: 224.10.10.10 , its decimal is 375875314. After we drop the highest nine bits, it becomes 657930. So, the Multicast MAC address is: 01:00:5e:0a:0a:0a. Here is a example C source code (GPL) to show this:

/*
Copyright (C) 2010 YKLin

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
void cvtIP2MAC(unsigned long, unsigned char*);

int main(int argc, char **argv){
char ipaddress[255]="224.10.0.1";
unsigned char buf[6] = {0x01, 0x0, 0x5e, 0x0, 0x0, 0x0};
struct in_addr inputAddress;
int ret;
memset(&inputAddress, 0x0, sizeof(inputAddress));
if(argc > 1){
strcpy(ipaddress, argv[1]);
}

ret = inet_aton(ipaddress, &inputAddress);
if(!ret){
printf("Dest address(%s) is incorrect:%d\r\n", ipaddress, ret);
return -1;
}
printf("Conver IP(%s, %u) to MAC...\r\n", ipaddress, ntohl(inputAddress.s_addr));
MIPv42MAC(ntohl(inputAddress.s_addr), buf);
printf("MAC: %02x %02x %02x %02x %02x %02x\r\n", buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
return 0;
}
void cvtIP2MAC(unsigned long ip, unsigned char *buf){
if(!buf){
return;
}
buf[5] = ip & 0xff;
buf[4] = (ip & 0xff00)>>8;
buf[3] = (ip & 0xff0000)>>16;
}

PPP dial on Demand

We set a set of private IP address for local and remote. When users request a connection, device sends a packet to remove to launch PPP dialing up.

In general case, we always the same dummy IP address set such as 10.64.64.64 for local and 10.112.112.112 for remote (Please refer to IPCP). There are a lot of user may confuse why my device always sends strange traffic to 10.112.112.112. Some applications of PPP use the previously IP which is assigned by PPP server to prevent this occurs.
We can also start to negotiate via using address 0.0.0.0 rather than 10.64.64.64. If you use PPP in linux, you can modify "ifaddr" as following configurations:

set ifaddr 10.64.64.64/0 10.112.112.112/0 255.255.255.255

Communication over ethernet mac layer without TCP/IP part 1

I use two different o.s. at a embedded system. Altohough, there are so many solutations such as broadcast, IP sockets, non-reliable IP-less protocol and so on, but they can not meet our requerments.

Here are my concept:
A protocol must base on ethernet layer II and has capability to do TCP-friendly stuff. The requerments are below:

• Can set or get system parameter between A and B.
• This protocol must be extendable from dual systems to multiple systems.
• It can not fix at client and server mode. These two (or more) system can be client and server at the same time.
• We can transfer large file or multipart request/response over a transaction. And the upper layer applications do not have to worry about fragmentations.
• This protocol must provide Event/Notify. A could register events which is occurred at B. After registation, B must send notify while some events happened.
  

Here are issues:

1. How to define session and transations?
2. How to encoding payload ?
3. How to implement re-transmit ?
4. others
   

Software generator

I find some software generators.
For Linux:

• packETH : GUI-based. So, I need X windows system to use this package. You can edit your won packet or load a tcpdump-formated file as source.
  
• scapy: text-based, Write by Python. You have to install python 2.4 or above version. If you need some extra feature, you also need to install gnuplot library, gnuplot-py, numpy, and PyX.

For Windows:
I only try CommView. There is a version for evaluation. You can use tcpdump formated file as source too.

Chang default IGMP version in Linux

Set default IGMP version of your NICs is 2:

echo 2 > /proc/sys/net/ipv4/conf/all/force_igmp_version

Set default IGMP version of your NICs is 3:

echo 3 > /proc/sys/net/ipv4/conf/all/force_igmp_version

Translate Decimal / IP dotted quad

Here are simple functions to translate decimal/ip dotted quad in python.
Usage:
>dot2dec("64.233.189.99")
1089060195L
>dec2dot(1089060195L)
'64.233.189.99'
>

import types
def dot2dec(ipForm, useHex = False):
 if type(ipForm) == types.StringType:
  ipf = ipForm.split(".")
 elif type(ipForm) in (types.ListType, types.TupleType):
  ipf = ipForm
 elif type(ipForm) in (types.LongType, types.IntType):
  return None
 return reduce(lambda a,b: long(a)*256 + long(b), ipf)

def dec2dot(numbericIP):
 if type(numbericIP) == types.StringType and not numbericIP.isdigit() :
  return None
 numIP = long(numbericIP)
 return "%d.%d.%d.%d" % ((numIP>>24)&0xFF, (numIP>>16)&0xFF, (numIP>>8)&0xFF, numIP&0xFF)

FYI:
python google group

Chang default IGMP version in windows

The default version of IGMP in windows XP is Version 3. If you want to change to version 2, please flowing setups below:
1.Add new filed in registries and set default value is 3:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"IGMPVersion"=dword:00000003
2.reboot

CaptureSetup VLAN tags

These days, network adapter becomes more and more smart. It filters VLAN tags automatic, so you can not read this filed from packet filter such as Wireshark. If your network adapter is old or simple enough, you do not have to worry about this problem otherwise, you should add extra variable at your registries within your windows.For example, If you use Broadcom NIC, you need to do flowing steps below:
1.Find TxCoalescingTicks.
2.Add new string value which named PreserveVlanInfoInRxPacket and default value is 1.
3.Reboot.

FYI:
The Wireshark CaptureSetup VLAN