Wireshark · Ethereal-users: Re: [Ethereal-users] sasser

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, May 11, 2004 at 07:51:22PM -0500, Chris T. wrote:
> I am using ethereal to track down infections on my network and I have a
> filter which I found on the internet.

Found it here?

	http://www.ethereal.com/lists/ethereal-users/200405/msg00103.html

Note that he suggests that there are other tools such as Snort that
might be better for tracking down worms on a network:

	http://www.snort.org/

	http://www.prelude-ids.org/

> This is the filter how do I tell it not to listen for ip address
> 172.16.0.175 ?
> 
> tcp[13]&3!=0 and (port 139 or port 445)

	not host 172.16.0.175 and tcp[13]&3!=0 and (port 139 or port 445)