Ethereal-users: Re: [Ethereal-users] limit packet capture by source ip address

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 5 Sep 2003 19:25:16 -0700

On Sep 5, 2003, at 11:50 AM, Andrew Sudron wrote:


Hi, I've just installed ethereal and am getting to
grips with it. Would someone be so kind as to tell me
how to limit packet capture by source ip address.

I know you can use the string ip.src == 192.168.1.1
No, you can't, actually - you have to use the string "ip host 192.168.1.1", if you truly mean "limit packet *capture*", rather than "limit the display of the packets you've already captured". Capture filters and display filters are different. 


but which menu options do you use to enable this?
There isn't one. You just enter that string in the "Filter:" field in the dialog box popped up by "Start" on the "Capture" menu.