Wireshark · Wireshark-users: Re: [Wireshark-users] filter to capture ospf pacets?

[Mike Savory <msavory-shark@xxxxxxxxx>]

On Nov 2, 2006, at 9:50 AM, LEGO wrote:

> cat /etc/protos
> > Now, I really ought to learn something from this exercise. What  
> > does the
> > proto keyword mean, and where can I look up values for it?


Try
 cat /etc/protocols

This works on my Mac.

For a more extensive list of what you can filter out, check out the  
following links

Filter based on Ether-Type
http://www.iana.org/assignments/ethernet-numbers

Filter based on Protocols
http://www.iana.org/assignments/protocol-numbers

Filter based on TCP/UDP Ports
(use proto=TCP or proto=UDP as well)
http://www.iana.org/assignments/port-numbers

For the syntax of capture filters see

  man tcpdump   (if you are on a unix box)
  http://wiki.wireshark.org/CaptureFilters

Regards

Mike