You are correct, I missed the ip.src. I know better then to try to do
filters w/o caffeine
On May 28, 2009, at 10:50 , Guy Harris wrote:
On May 28, 2009, at 7:02 AM, Kevin wrote:
Why would you use the display filter? Try -f "host 10.20.30.20 and
tcp"
Or, if he was using a display filter of "ip.src == 10.20.30.20", a
capture filter of "src host 10.20.30.20 and tcp".
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-
users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe