Ethereal-users: Re: [Ethereal-users] Filter Files

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 21 Feb 2003 13:28:04 -0800
On Thu, Feb 20, 2003 at 03:43:50PM +0000, mark.haslam@xxxxxxxx wrote:
> But are there any resources that will allow me to capture data from Server
> Message Block Protocol or related ports.

Do you mean "capture *only* data from SMB or related ports"?

If so, then try, as a capture filter,

	udp port 137 or udp port 138 or tcp port 139 or tcp port 445

if you're running NetBIOS-over-TCP (or CIFS-over-TCP; that's port 445).

> The reason for this is I am trying to find a way to capture any user on my
> comp LAN sending NETSend messages across the network.

That also requires that you be able to see all the traffic on your LAN;
see

	http://www.ethereal.com/faq.html#q5.1

for some of the issues involved with doing that on, for example, a
switched network.