On Wed, Feb 06, 2008 at 10:14:29PM +0100, Sake Blok wrote: > On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote: > > > > I would also like to filter NBNS protocol. Right now I have a display > > filter like this: > > nbns.flags == 0x2810 || nbns.flags == 0x2910 > > > > Again, I'd rather have this in a capture filter in case I want to start > > saving it. > > You could use something like: > > udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910
Oops, that should of course be: "udp port 137 and (udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910)" Cheers, Sake _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
