Wireshark-users: Re: [Wireshark-users] capture filter

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 04 May 2007 10:35:37 -0700

Tom Greaser wrote:

Thanks Guy.. JUST want i was asking for
i will remember to man tcpdump  next time ..

Well, the man page is a start, but the "expr relop expr" section is a bit of Full Frontal Capture Filter[*] - you have to know that the capability is there, and you then have to go from that to the particular type of filter you need, so it's a bit more than just "RTFM".

[*]Rob Gingell at Sun once contrasted the dbxtool GUI app in SunOS with using what he called "full frontal dbx" as the debugger. I've used variants of the phrase since then as a term for using various things without the help the friendly front ends....