Wireshark-users: Re: [Wireshark-users] filter to capture ospf pacets?

From: Mike Savory <msavory-shark@xxxxxxxxx>
Date: Thu, 2 Nov 2006 10:13:24 -0800

On Nov 2, 2006, at 9:50 AM, LEGO wrote:

cat /etc/protos

Now, I really ought to learn something from this exercise. What does the

proto keyword mean, and where can I look up values for it?

Try
 cat /etc/protocols

This works on my Mac.

For a more extensive list of what you can filter out, check out the following links

Filter based on Ether-Type
http://www.iana.org/assignments/ethernet-numbers

Filter based on Protocols
http://www.iana.org/assignments/protocol-numbers

Filter based on TCP/UDP Ports
(use proto=TCP or proto=UDP as well)
http://www.iana.org/assignments/port-numbers

For the syntax of capture filters see

  man tcpdump   (if you are on a unix box)
  http://wiki.wireshark.org/CaptureFilters

Regards

Mike