[Sake Blok <sake@xxxxxxxxxx>]

On Wed, Feb 06, 2008 at 10:14:29PM +0100, Sake Blok wrote:
> On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote:
> > 
> > I would also like to filter NBNS protocol. Right now I have a display
> > filter like this:
> > nbns.flags == 0x2810 || nbns.flags == 0x2910
> > 
> > Again, I'd rather have this in a capture filter in case I want to start
> > saving it.
> 
> You could use something like:
> 
> udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910

Oops, that should of course be:

"udp port 137 and (udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910)"

Cheers,
   Sake