Wireshark-users: Re: [Wireshark-users] Capture Filter Help

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 6 Feb 2008 20:02:55 +0100

On Wed, Feb 06, 2008 at 01:51:43PM -0500, James Pifer wrote:
> Hi. I've been googling and using the wiki but I can't figure out if this
> is possible. 
> 
> I'm trying setup a capture filter to capture only data where the ip
> address contains a certain part of an ip address. We have a lot of
> servers on a distributed network that have standard addresses. 
> 
> For example, I'd like to capture data on port 137 if the ip address is
> like 192.xxx.xxx.11 where xxx can be anything. 
> 
> Can this be done in a capture filter? Looks like it can be done in a
> display filter, but I really don't want that. 

How'bout looking at the specific locations within the ip-packet for
src address or destination address:

ip[0xc]==192 and ip[0xf]==11

Would match any packet from 192.x.x.11 and 

ip[0x10]=192 and ip[0x13]==11

would match and packet to 192.x.x.11.

So the full filter would be:

"((ip[0xc]==84 and ip[0xf]==11) or (ip[0x10]=84 and ip[0x13]==11)) and port 137"

Hope this helps,
Cheers,
    Sake