> How'bout looking at the specific locations within the ip-packet for
> src address or destination address:
>
> ip[0xc]==192 and ip[0xf]==11
>
> Would match any packet from 192.x.x.11 and
>
> ip[0x10]=192 and ip[0x13]==11
>
> would match and packet to 192.x.x.11.
>
> So the full filter would be:
>
> "((ip[0xc]==84 and ip[0xf]==11) or (ip[0x10]=84 and ip[0x13]==11)) and port 137"
>
> Hope this helps,
> Cheers,
> Sake
Sake,
I'm trying this, just waiting for something to come in.
I would also like to filter NBNS protocol. Right now I have a display
filter like this:
nbns.flags == 0x2810 || nbns.flags == 0x2910
Again, I'd rather have this in a capture filter in case I want to start
saving it. What is the best capture reference? Maybe I've not come
across it yet.
Thanks for the help.
James