[Guy Harris <guy@xxxxxxxxxxxx>]

On Fri, Dec 05, 2003 at 02:19:11PM -0500, Ridgeway, Alan wrote:
> After I capture traffic, I can go to the Display Filter field and enter the following:
> 
> "not browser" This will filter all protocols related to the windows network browser
> "ip.adder eq xxx.xxx.xxx.xxx" This filter will only display the IP address defined in after the "eq"

Presumably you mean "ip.addr".

> I can not however get this filter to work with
> "ip.adder eq <hostname>" 
> "ip.scr eq <hostname>" 
> "ip.dst eq <hostname>" 

What does it do instead of working?  Does it complain that it can't
translate the host name to an IP address, or does it just fail to find
the packets?

If it fails to find the packets, is there more than one IP address
corresponding to that host name?  If so, note that we currently don't
handle that the same way libpcap capture filters do - we *should* match
any of the IP addresses, but we don't.