Ethereal-users: Re: [Ethereal-users] Display Filter and Capture Filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Tue, 08 Mar 2005 13:51:46 -0500
>On Mon, 2005-03-07 at 02:47, Eric Lam, Fu Wa wrote:
>> I am new to Ethereal (0.10.7). I set up a display filter
>> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
>> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510). Would anyone
>> teach me how to setup the capture filter so that only the traffic with
>> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
>> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510) will be captured.
>> Many thanks.



It may be painful to do.  But you *may* be able to do this by using the binary AND feature of tcpdump syntax.  For example "tcp[13:1] & 3 != 0"  will catch all SYN and FIN packets.

You may be able to craft such a filter.  But if you have the disk space, you may want to filter this in Ethereals display filter

hsb