Ethereal-users: RE: [Ethereal-users] Display Filters -- Wildcards?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Foster <jfoste@xxxxxxxxxxxx>
Date: Fri, 14 Dec 2001 15:17:37 -0600
From: Arthur Dent [mailto:arthurdent99@xxxxxxxxxxx]
Sent: Friday, December 14, 2001 2:14 PM

> I would like to set up a display filter to show any traffic that is not 
> native to my local network (in other words, any traffic entering my
network 
> from the outside, and any traffic leaving my network for the outside).
....
> Is there any way to use wildcards with IP addresses?  I'd hate to have to 
> type all the IP addresses manually.


You can use a slice on the ip field, so try something like this 

ip[12-14] != c0:a8:01 or ip[16-18] != c0:a8:01

This will do a slice on the ip header at the source and destination address.

Good Luck,
Jeff Foster
jfoste@xxxxxxxxxxxx

***
The information in this e-mail is confidential and intended solely for the
individual or entity to whom it is addressed. If you have received this
e-mail in error please notify the sender by return e-mail, delete this
e-mail, and refrain from any disclosure or action based on the information.
****