[Guy Harris <gharris@xxxxxxxxx>]

On Sun, Mar 09, 2003 at 06:08:30PM -0500, James Fields wrote:
> For a capture filter (i.e. only capture packets that match this filter):
> 
> host 192.168.0.1
> 
> That should work regardless of whether that IP address is the source
> or destination in the packet. 

And if you want to check only the source address, try

	src host 192.168.0.1

The capture filter syntax is described in the tcpdump/WinDump manual for
the version of tcpdump/WinDump that goes with whatever version of
libpcap/WinPcap you have installed; for WinPcap 2.3, that's

	http://windump.polito.it/docs/manual.htm

Look for the

	expression 
	     selects which packets will be dumped.  If no expression is
	     given, all packets on the net will be dumped.  Otherwise,
	     only packets for which expression is `true' will be dumped.

			...

section.