Ethereal-users: Re: [Ethereal-users] Narrow the trace

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 22 Apr 2004 21:57:12 -0700
On Fri, Apr 23, 2004 at 04:42:57AM +0200, GRL wrote:
> I'd like to narrow the trace for a specific http session (I mean, to a
> web site).  How can I do?

If you're capturing, use

	host {web site domain name or IP address}

as a capture filter.

If you've already captured, use

	ip.addr == {web site domain or IP address}

as a display filter, although note that the display filter (unlike the
capture filter) won't handle a domain name that has more than one IP
address associated with it (it'll just match the first one it's seen).

If you also need to worry about the *client* machine, do

	host {web server} and host {web client}

as a capture filter and

	ip.addr == {web server} and ip.addr == {web client}

as a display filter.