["Dean" <dfields@xxxxxxxxxx>]

I am new to ethereal. When windows 2000 logs a Failed Logon it gives the Username, Workstation Name in event description (Over the internet). But for some reason never the IP address (2003 does). Given workstation name I would like to find the IP address in a capture filter (display filter would be interesting also). Finding packets given the username might also be interesting.

 

I have reviewed the filtering language but its a little confusing. Does anyone have a link to a good tutorial with lots of examples - for the beginner.

 

Thanks,

Dean