> How'bout looking at the specific locations within the ip-packet for > src address or destination address: > > ip[0xc]==192 and ip[0xf]==11 > > Would match any packet from 192.x.x.11 and > > ip[0x10]=192 and ip[0x13]==11 > > would match and packet to 192.x.x.11. > > So the full filter would be: > > "((ip[0xc]==84 and ip[0xf]==11) or (ip[0x10]=84 and ip[0x13]==11)) and port > 137" > > Hope this helps, > Cheers, > Sake
Sake, I'm trying this, just waiting for something to come in. I would also like to filter NBNS protocol. Right now I have a display filter like this: nbns.flags == 0x2810 || nbns.flags == 0x2910 Again, I'd rather have this in a capture filter in case I want to start saving it. What is the best capture reference? Maybe I've not come across it yet. Thanks for the help. James _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
