Ethereal-users: Re: [Ethereal-users] Filtering by source

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 4 Dec 2002 14:43:03 -0800
On Wed, Dec 04, 2002 at 03:52:47PM -0500, Parks, Chauni wrote:
> Dumb question:  Is there a way to filter by source?

There are ways of filtering the display by a huge number of things.

For example, to filter by IPv4 source address, do

	ip.src == {address}

where "{address}" can either be an IP address or a host name.

> Can you do this  with out having to filter before the capture is started?

Yes - the filter above is a display filter.

You can also filter by source address when capturing, with

	src host {address}