title: Building Wireshark LDAP filter for future scripting
body: <p>all </p>
  
  <p>On our environment we have several servers still using ldap for authentication and I need to filter ldap requests for 8 hours to have an overview on how many different accounts we may have exposed.</p>
  
  <p>The issue is I cannot create captures that are too large. (Just for an example, using a filter to ldap port and marking the flags of a TCP request I barely can capture 3 minutes before my capture is hitting 100MB).</p>
  
  <p>I wonder if there is a way to build a capture filter that would look for a HEX on the DATA part of the packet.</p>
  
  <p>Does anyone have any clue on how I would be able to do that?</p>
  
  <p>Currently I am using a capture filter like: </p>
  
  <pre><code>port 389 &amp;&amp; tcp[13] == 24
  </code></pre>
  
  <p>and a display filter like:  </p>
  
  <pre><code>ldap.bindRequest_element &amp;&amp; ldap.messageID==1
  </code></pre>
  
  <p>Another issue is that doing this I couldn't come up with a script that would strip the username so I could inform all possibly compromised users to change their PWDs.</p>
  
  <p>Thanks in advance</p>