On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote:
>
> I would also like to filter NBNS protocol. Right now I have a display
> filter like this:
> nbns.flags == 0x2810 || nbns.flags == 0x2910
>
> Again, I'd rather have this in a capture filter in case I want to start
> saving it.
You could use something like:
udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910
Why? Because the udp header is 8 bytes long, and then there are
two bytes for the NBNS Transaction ID. The following two bytes
(starting from position 0xa (=10) relative to the start of the UDP header)
will be the nbns flags.
> What is the best capture reference? Maybe I've not come
> across it yet.
Start at:
http://www.ethereal.com/docs/eug_html_chunked/ChCapCaptureFilterSection.html
and also follow the link at the bottom of that page to:
http://www.tcpdump.org/tcpdump_man.html
That should get you on your way. Apart from that, it's being creative
with what is offered by the libpcap filter format.
Cheers,
Sake