On Mon, Apr 22, 2002 at 07:34:50PM -0500, Ron Stordahl wrote:
> Can someone help me set up a capture filter for UDP?
>
> I would guess the steps would be: Edit / New
"Set up" in what sense?
The "Capture Filters..." item in the "Edit" menu is for editing the list
of *store* capture filters.
However, you don't *need* to have stored capture filters; you can just
put the filter expression in the "Filter" box in the "Capture Options"
dialog box popped up when you select "Start" from the "Capture" menu.
> and at the point I don't know what to do. Apparently this is defined
> in tcpdump, but I have no idea where to find that.
The online Ethereal man page:
http://www.ethereal.com/ethereal.1.html
has a "SEE ALSO" section:
http://www.ethereal.com/ethereal.1.html#lbGM
which links to an online tcpdump man page:
http://www.ethereal.com/tcpdump.8.html
but the capture filter expression for UDP is, err, umm, just "udp".
> After defining the filter, I would apparently use the declared name in
> the Capture options / Filter name.
No.
You can *not* use declared names in that field. You can only use
capture filter expressions in that field, so you could put "udp" in that
field.
If you happen to have stored capture filters, you can retrieve them by
clicking on the "Filter:" button next to that field.
But, as noted, you *don't* need to have stored capture filters. You'd
store a capture filter if you use it a lot and don't want to have to
type it every time.