Ethereal-users: RE: [Ethereal-users] Filter out LLC protocal packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Ow Mun Heng" <ow.mun.heng@xxxxxxx>
Date: Thu, 20 Nov 2003 15:18:11 +0800

> -----Original Message-----
> From: Guy Harris [mailto:guy@xxxxxxxxxxxx]
> Sent: Thursday, November 20, 2003 11:01 AM

> And if you want to see IP frames, but not IP frames with DNS 
> traffic in 
> them and not IP frames to or from the machine running Ethereal, then
> 
> 	ip && !port 53 && !host {machine running Ethereal}
> 
> will work.  (You don't need "!arp" - ARP packets aren't IP packets.)


That works just fine.. Thanks.