On Wed, Feb 06, 2008 at 01:51:43PM -0500, James Pifer wrote:
> Hi. I've been googling and using the wiki but I can't figure out if this
> is possible.
>
> I'm trying setup a capture filter to capture only data where the ip
> address contains a certain part of an ip address. We have a lot of
> servers on a distributed network that have standard addresses.
>
> For example, I'd like to capture data on port 137 if the ip address is
> like 192.xxx.xxx.11 where xxx can be anything.
>
> Can this be done in a capture filter? Looks like it can be done in a
> display filter, but I really don't want that.
How'bout looking at the specific locations within the ip-packet for
src address or destination address:
ip[0xc]==192 and ip[0xf]==11
Would match any packet from 192.x.x.11 and
ip[0x10]=192 and ip[0x13]==11
would match and packet to 192.x.x.11.
So the full filter would be:
"((ip[0xc]==84 and ip[0xf]==11) or (ip[0x10]=84 and ip[0x13]==11)) and port 137"
Hope this helps,
Cheers,
Sake