Wireshark · Ethereal-dev: Re: [ethereal-dev] packet capture from switches and other RMON devices

[guy@xxxxxxxxxx (Guy Harris)]

> I guess I was unclear.  Let's say we have one device running Ethereal and 
> three capture devices at 10.1.9.65, 10.1.10.65 and 10.1.11.65. What I mean is 
> I'd like a filter saying "collect in Ethereal only packets from the capture 
> device whose IP is 10.1.9.65".  That capture device could have a capture 
> filter of its own

I'd see that done by specifying, when you tell Ethereal which devices to
use to capture, tell it to use "RMON to 10.1.9.65" (or maybe just "use
10.1.9.65", with Ethereal figuring out whether to use the remote wiretap
or remote pcap protocol, or RMON, or whatever), and separately say
"capture only UDP packets" when you set up the capture filter (which I
view as being not a filter specifying which devices to use, but just as
a filter specifying what types of packets to capture; I view the
selection of devices as being something other than a filter - i.e., it's
a terminology issue).