From: Jeff
Liegel
Sent: Tuesday,
January 12, 2010 4:28 PM
To:
'wireshark-users@xxxxxxxxxxxxx'
Subject: src host capture filter not
working
Importance:
High
Hi. I
desperately need to see packets coming from OR going to ip 207.35.208.194
using capture filter
Works fine with
display filter only but this is a really busy network and I need to ultimately
save the capture to a file thus need a capture filter.
[]# tshark -i eth1 -R "ip.dst ==
207.35.208.194 or ip.src == 207.35.208.194"
Capturing on
eth1
13.306484 207.35.208.194
-> 208.77.1.33 SIP Request: REGISTER
sip:proxyc11b.italkbb.com
13.307911 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
20.787232 207.35.208.194
-> 208.77.1.33 SIP Request: REGISTER
sip:proxyc11b.italkbb.com
20.788120 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
Just host should show
packets both ways (like example above) and does not
[]# tshark -i eth1 host
207.35.208.194
Capturing on
eth1
0.000000 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
7.475218 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
6 packets
captured
Src host does not
work but dst host does work
[]# tshark -i eth1 dst host
207.35.208.194 or src host 207.35.208.194
Capturing on
eth1
0.000000 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
7.475218 208.77.1.33
-> 207.35.208.194 SIP Status: 200 OK (1
bindings)
6 packets
captured
This shows that src
host does not work all by itself either
[]# tshark -i eth1 src host
207.35.208.194
Capturing on
eth1
0 packets
captured
Here is my version
stuff
TShark
1.0.3
Copyright 1998-2008 Gerald Combs
<gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the
source for copying conditions. There is NO
warranty; not even for
MERCHANTABILITY or FITNESS FOR A PARTICULAR
PURPOSE.
Compiled with GLib 2.12.3, with
libpcap 0.9.4, with libz 1.2.3, without POSIX
capabilities, with libpcre 6.6,
with SMI 0.4.5, without ADNS, without Lua, with
GnuTLS 1.4.1, with Gcrypt 1.2.3,
with MIT Kerberos.
Running on Linux
2.6.18-92.1.22.el5, with libpcap version 0.9.4.
Built using gcc 4.1.2 20071124
(Red Hat
4.1.2-42).