Ethereal-users: Re: [ethereal-users] How can I filter Bootp and STP?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 3 Aug 2000 17:29:40 -0700 (PDT)
> Even though Ethereal recognises STP and BOOTP as protocols there is no way
> to say for example not proto bootp. Is there a way other than using specific
> ip addresses and tcp ports?

Well, STP doesn't run atop IP, so you can't filter for it with IP
addresses or TCP ports; see

	http://ethereal.zing.org/lists/ethereal-users/200007/msg00148.html

for the ways to filter for STP in programs using libpcap (e.g., tcpdump,
Ethereal, etc.).

For BOOTP, you have to filter on a specific *UDP* port (BOOTP runs atop
UDP) - that's how Ethereal recognizes BOOTP - but you can probably do

	udp port bootps

("s" in "bootps" stands for "server"; the "/etc/services" file on
Solaris 2.6, at least, has a separate "bootpc" for the client), but, if
that filter is rejected, try

	udp port 67