On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote: > > I would also like to filter NBNS protocol. Right now I have a display > filter like this: > nbns.flags == 0x2810 || nbns.flags == 0x2910 > > Again, I'd rather have this in a capture filter in case I want to start > saving it.
You could use something like: udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910 Why? Because the udp header is 8 bytes long, and then there are two bytes for the NBNS Transaction ID. The following two bytes (starting from position 0xa (=10) relative to the start of the UDP header) will be the nbns flags. > What is the best capture reference? Maybe I've not come > across it yet. Start at: http://www.ethereal.com/docs/eug_html_chunked/ChCapCaptureFilterSection.html and also follow the link at the bottom of that page to: http://www.tcpdump.org/tcpdump_man.html That should get you on your way. Apart from that, it's being creative with what is offered by the libpcap filter format. Cheers, Sake _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
