Retina currently does not support filtering for packets if the specified filter requires both (1) fields that are only available in packets and (2) application-layer data.
For example, you cannot filter for "tls packets that are larger than X" or "http SYN packets for a Mozilla user-agent".
Five-tuple fields, which are constant throughout the connection, are an exception to this rule.
Retina currently does not support filtering for packets if the specified filter requires both (1) fields that are only available in packets and (2) application-layer data.
For example, you cannot filter for "tls packets that are larger than X" or "http SYN packets for a Mozilla user-agent".
Five-tuple fields, which are constant throughout the connection, are an exception to this rule.