Ethereal-users: Re: [Ethereal-users] Feature for NAT Capture Filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 30 Apr 2005 15:14:17 -0700
Al Stu wrote:
I would like to use Ethereal to capture packets of traffic not matching a request from the NAT. So if Ethereal was to see a packet from 1.2.3.4 port 3597 but Ethereal had not seen a request from the NAT matching this (within last n seconds), then it would capture that packet.
The capture filter mechanism in many OSes (as used by libpcap) and in libpcap is stateless and has no notion of timeouts, so a filter of the type you describe can't be implemented as a regular capture filter.
It might be possible to implement it in Ethereal, so that it'd capture all packets and discard the uninteresting ones in user space.
What do you mean by "request from the NAT"? If you're sniffing on the WAN side of the NAT, do you mean "packet from a host behind the NAT"?