Give Me Too .com - Give Me Too Filter Editors: String Filter

Quick start | Program Settings | Filter Editors | Command Line Parameters | Capture in switched LAN | Capture Dial-Up (Modem) Traffic | Processing Dump Files | System Requirements | Product Registration

---

String Filter MIME Types Filter IP Filter

---

The HTTP, FTP, SMTP, POP3, IMAP, IRC decoders can use this filter to manage captured data according to the substrings found in the URLs, filenames, e-mail addresses, account names, nicks, channel names (filtered string).
In this filter you can specify any sequences of symbols the filtered string (URL, filename, etc) must or must not include.

The filter is case insensitive.

Filtering Rules:

1) Both the Enabled substrings and the Disabled substrings lists are empty.

All data is accepted.

2) The Enabled substrings list is empty, the Disabled substrings list contains some strings.

All filtered strings are checked for the substrings contained in the Disabled substrings list. If a match is found, all data corresponding to the filtered string is rejected.

3) The Disabled substrings list is empty, the Enabled substrings list contains some strings.

All filtered strings are checked for the substrings contained in the Enabled substrings list. If a match is found, all data corresponding to the filtered string is processed, otherwise all data is rejected.

4) Both the Enabled substrings and the Disabled substrings lists contain some rules.

Rule 2) is applied first, and then Rule 3).

Example1 (URL filtering):

1) We want to capture files from the pictures directory only.

Add the pictures substring to the Enabled substrings list.

2) We want to capture files that have pict in their names, unless they are stored in the thumb directory.

Add the pict substring to the Enabled substrings list.
Add the thumb substring to the Disabled substrings list.

Example2 (e-mail filtering):

1) We want to track all messages sent to the hotmail.com accounts (outgoing messages, the recipient's address specified in the TO: field is tracked).

Add the @hotmail.com substring to the Enabled substrings list.

2) We want to track all messages sent from the @hotmail.com accounts except messages sent by agent007 (incoming messages, the sender's address specified in the FROM: field is tracked).

Add the @hotmail.com substring to the Enabled substrings list.
Add the agent007@ substring to the Disabled substrings list.