[Wireshark Start/stop Capture Based On Data]

I tried to find some decent documentation if this feature was available, but i couldn't find anything. Just to make sure is anyone aware of a filter or option in which to limit captures based on data? For example, I'm sniffing a network under heavy traffic, and so i thought a good idea to lessen the pressure was to start a capture once a specific package data was detect, then have it capture "everything" until another specific package data was detected, at which point it stops capturing until another "start" package was detected.

This method would help if an application uses a specific port initially, but then randomly sends data during its usage. Such as the MSN protocol. What I'm trying to achieve is to isolate the capture to start when i Sign into msn, then capture all my traffic until i sign out.

[BIOS Password Bypass]

The ThinkPads are a special case when it comes to removing / resetting the bios password.

Most Lenovo (IBM) Laptops are only secured by a hdd password which can (you guessed it) removed by replacing the hdd. you'll most likely get errors / warnings about a none genuine lenovo harddisk blablabla (that one can be fixed by an update from the lenovo support website)

As far as i know, most of the never thinkpads, especially the T series, have TPM chips (some are on a removable board). don't even try to remove the TPM board an start the machine, it won't work.

If only the Bios Master password is set, you might have a change because you can get into the bios in some sort of "user mode". That means that you can change only some options.

As a matter of fact I just got a Thinkpad which has its supervisor password stored on an ATMEL chip, most Thinkpads are now using ATMEL for storing passwords, and they require hardware to hack. You need to dump the data on them then decrypt using IBMPass.

http://www.allservice.ro/forum/viewtopic.php?t=47

I'm going to do it later, when i get permission from the owner of the thinkpad :)