Ethereal-users: Re: [Ethereal-users] Filter out LLC protocal packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 19 Nov 2003 19:01:28 -0800

On Nov 19, 2003, at 6:57 PM, Guy Harris wrote:
... unless you *only* want to see IP frames, in which case a capture filter of just 

	ip

will work.
And if you want to see IP frames, but not IP frames with DNS traffic in them and not IP frames to or from the machine running Ethereal, then 

	ip && !port 53 && !host {machine running Ethereal}

will work.  (You don't need "!arp" - ARP packets aren't IP packets.)