On Mon, 4 Dec 2000, Mitchell K. Smith wrote:
> I am trying now to create a filter for ALL udp ports.
>
> Can you help me with the syntax?
>
> port udp <something?>
For capturing you could use "ip proto 17" or "ip proto \udp" (note the
backslash). The equivalent display filter would be "ip.proto == 17" or
simply "udp".
> Is there a definitive reference for ethereal so I don't have to keep bugging
> you guys.
The capture filter syntax is described in the tcpdump man page. Display
filters are described in the Ethereal man page. More friendly
descriptions of each can be found in the Ethereal User's Guide, at
http://www.ns.aus.com/ethereal/user-guide/ch03capfilt.html
and
http://www.ns.aus.com/ethereal/user-guide/ch03dispfilt.html
respectively.
>
> Thanks for your help.
>
> Mitch Smith
>
>
>
> -----Original Message-----
> From: McNutt, Justin M. [mailto:McNuttJ@xxxxxxxxxxxx]
> Sent: Sunday, December 03, 2000 12:17 PM
> To: 'Gerald Combs'; Mitchell K. Smith
> Cc: 'ethereal-users@xxxxxxxxxxxx'
> Subject: RE: [Ethereal-users] help with filter syntax
>
>
> That will work, but remember that SNMP traps are sent on UDP port 162 (by
> default). Try:
>
> udp.port == 161 or udp.port == 162
>
> --J
>
> > -----Original Message-----
> > From: Gerald Combs [mailto:gerald@xxxxxxxx]
> > Sent: Thursday, November 30, 2000 1:58 PM
> > To: Mitchell K. Smith
> > Cc: 'ethereal-users@xxxxxxxxxxxx'
> > Subject: Re: [Ethereal-users] help with filter syntax
> >
> >
> > On Thu, 30 Nov 2000, Mitchell K. Smith wrote:
> >
> > > Greetings.
> > >
> > > I am new to using Ethereal and I need some help with the
> > filter syntax.
> > > I am using version 0.8.14.
> > >
> > > I am trying to capture SNMP packets only.
> > >
> > > I read the tcpdump man page but I still don't "get it"
> > >
> > > What would the syntax be for the filter field?
> >
> > SNMP uses UDP port 161, so the capture filter would be "udp
> > port 161", or
> > simply "port 161". In case you need it the display filter would be
> > "snmp" or "udp.port == 161".
> >
> >
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> >
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
