Ethereal-dev: Re: [Ethereal-dev] Capture Filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Nathan Jennings <njen@xxxxxxxxxxxx>
Date: Fri, 19 Aug 2005 21:08:36 -0400
Michael Back wrote:
Could you explain how I would set up a capture filter to monitor Destination / Source, Source / Destination for ports 445 and 139? 



tethereal -n -s 1514 -i <dev_name> 'tcp and (port 445 or 139)'
Depending on whether or not you care about what's in the payload once it's captured, you could leave out the "-s 1514" (snap length).
If you need it, use the "-w <file_name>" option to write the capture to a file. 

Also see:
(there are more precise worm examples here)
http://wiki.ethereal.com/CaptureFilters
http://wiki.ethereal.com/Performance