Ethereal-users: Re: [Ethereal-users] How would the syntax be for capture on IP address

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "James Fields" <jvfields@xxxxxxx>
Date: Sat, 18 Jan 2003 00:12:46 -0500
I apologize if I have misunderstood, but I believe you are asking how to
discard packets whose source and destination are both within your own local
network, while capturing those sourced from the dialup user.  For example,
suppose you used the class C address space 192.168.1.0/24 on your local
network, but dialup users were assigned 172.16.0.0/16 addresses.  You would
want to ignore packets where BOTH the source AND destination were in the
network 192.168.1.0/24 while still capturing any packets where the source OR
destination were in that network.  That way you'd be able to more easily
spot the dialup user on 172.16.x.x.

The capture filter would look like this:

not src net 192.168.1.0/24 and dst net 192.168.1.0/24

This would discard anything where the source and destination are both in the
specified network.


----- Original Message -----
From: <Ken_Okenka@xxxxxxx>
To: <ethereal-users@xxxxxxxxxxxx>
Sent: Friday, January 17, 2003 1:03 PM
Subject: [Ethereal-users] How would the syntax be for capture on IP address