At 12:13 PM 10/18/2003, RBogle@xxxxxxxxxxxxxxxx wrote:
I would like to capture all packets on ports 665 to 750 and only those
packets. I have not found a way to create a capture filter to accomplish this.
I tried a display filter of (tcp.port > 664 and tcp.port < 751) however
that displayed all ports.
The reason your filter didn't work is probably because tcp.port checks
against both the source and destination port. Most TCP traffic uses a high
port number in at least one direction. For example, if a TCP packet has a
source port of 25 and a destination port of 1483, that will match your
filter because 25 is < 751 and 1483 is > 664.
Depending on if you want traffic with a source, destination or either port
in the specified range you might try:
tcp.srcport > 664 and tcp.srcport < 751
tcp.dstport > 664 and tcp.dstport < 751
(tcp.srcport > 664 and tcp.srcport < 751) or (tcp.dstport > 664 and
tcp.dstport < 751)
I don't believe the capture syntax allows a range of ports.