My mistake - I forgot the parenthesis which are crucial to have the intended
effect. It should be:
not (src net 192.168.1.0/24 and dst net 192.168.1.0/24)
----- Original Message -----
From: "James Fields" <jvfields@xxxxxxx>
To: <ethereal-users@xxxxxxxxxxxx>; <Ken_Okenka@xxxxxxx>
Sent: Saturday, January 18, 2003 12:12 AM
Subject: Re: [Ethereal-users] How would the syntax be for capture on IP
address
> I apologize if I have misunderstood, but I believe you are asking how to
> discard packets whose source and destination are both within your own
local
> network, while capturing those sourced from the dialup user. For example,
> suppose you used the class C address space 192.168.1.0/24 on your local
> network, but dialup users were assigned 172.16.0.0/16 addresses. You
would
> want to ignore packets where BOTH the source AND destination were in the
> network 192.168.1.0/24 while still capturing any packets where the source
OR
> destination were in that network. That way you'd be able to more easily
> spot the dialup user on 172.16.x.x.
>
> The capture filter would look like this:
>
> not src net 192.168.1.0/24 and dst net 192.168.1.0/24
>
> This would discard anything where the source and destination are both in
the
> specified network.
>
>
> ----- Original Message -----
> From: <Ken_Okenka@xxxxxxx>
> To: <ethereal-users@xxxxxxxxxxxx>
> Sent: Friday, January 17, 2003 1:03 PM
> Subject: [Ethereal-users] How would the syntax be for capture on IP
address
>
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>