Wireshark-users: Re: [Wireshark-users] Capture Filter Help

From: James Pifer <jep@xxxxxxxxxxxxxxxx>
Date: Wed, 06 Feb 2008 14:46:21 -0500

> How'bout looking at the specific locations within the ip-packet for
> src address or destination address:
> 
> ip[0xc]==192 and ip[0xf]==11
> 
> Would match any packet from 192.x.x.11 and 
> 
> ip[0x10]=192 and ip[0x13]==11
> 
> would match and packet to 192.x.x.11.
> 
> So the full filter would be:
> 
> "((ip[0xc]==84 and ip[0xf]==11) or (ip[0x10]=84 and ip[0x13]==11)) and port 137"
> 
> Hope this helps,
> Cheers,
>     Sake

Sake, 

I'm trying this, just waiting for something to come in. 

I would also like to filter NBNS protocol. Right now I have a display
filter like this:
nbns.flags == 0x2810 || nbns.flags == 0x2910

Again, I'd rather have this in a capture filter in case I want to start
saving it. What is the best capture reference? Maybe I've not come
across it yet.

Thanks for the help.
James