someip协议过滤

HarkerYX

于 2024-10-24 23:54:05 发布

阅读量363

点赞数 2

CC 4.0 BY-SA版权

文章标签： 1024程序员节

本文链接：https://blog.csdn.net/yexiangCSDN/article/details/143222826


# 过滤 find
someipsd.entry.type == 0x00 

# 过滤 offer/ stopoffer 报文
someipsd.entry.serviceid == 0x1503 && someipsd.entry.type == 0x01
someip.serviceid == 0x7101 || someipsd.entry.serviceid == 0x7101
someipsd.entry.type == 0x01 # 有问题，竟然过滤不出 stopoffer
# 过滤 sub
someipsd.entry.serviceid == 0x1503 && someipsd.entry.type == 0x06

# 过滤 sub ack/nack
someipsd.entry.serviceid == 0x1503 && someipsd.entry.type == 0x07

someip.messagetype == 0x80  # respone
someip.messagetype == 0x00  # request

# method respone
someip.serviceid == 18221 && someip.methodid == 12291 && someip.messagetype == 0x80
# method request
someip.serviceid == 18221 && someip.methodid == 12291 && someip.messagetype == 0x00
# 过滤只有 method
someip.methodid < 0x8000 

# 过滤 option endpoint entry
someipsd.option.type == 0x24

# 过滤 Initial Event Request
someipsd.flags.exp_init_events