Wireshark-users: Re: [Wireshark-users] filter to capture ospf pacets?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Mike Savory <msavory-shark@xxxxxxxxx>
Date: Thu, 2 Nov 2006 10:13:24 -0800

On Nov 2, 2006, at 9:50 AM, LEGO wrote:


cat /etc/protos
Now, I really ought to learn something from this exercise. What does the 
proto keyword mean, and where can I look up values for it?



Try
 cat /etc/protocols

This works on my Mac.
For a more extensive list of what you can filter out, check out the following links 

Filter based on Ether-Type
http://www.iana.org/assignments/ethernet-numbers

Filter based on Protocols
http://www.iana.org/assignments/protocol-numbers

Filter based on TCP/UDP Ports
(use proto=TCP or proto=UDP as well)
http://www.iana.org/assignments/port-numbers

For the syntax of capture filters see

  man tcpdump   (if you are on a unix box)
  http://wiki.wireshark.org/CaptureFilters

Regards

Mike