Wireshark-users: Re: [Wireshark-users] Capture Filter Help

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 6 Feb 2008 22:14:29 +0100

On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote:
> 
> I would also like to filter NBNS protocol. Right now I have a display
> filter like this:
> nbns.flags == 0x2810 || nbns.flags == 0x2910
> 
> Again, I'd rather have this in a capture filter in case I want to start
> saving it.

You could use something like:

udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910

Why? Because the udp header is 8 bytes long, and then there are
two bytes for the NBNS Transaction ID. The following two bytes
(starting from position 0xa (=10) relative to the start of the UDP header)
will be the nbns flags.

> What is the best capture reference? Maybe I've not come
> across it yet.

Start at:

http://www.ethereal.com/docs/eug_html_chunked/ChCapCaptureFilterSection.html

and also follow the link at the bottom of that page to:

http://www.tcpdump.org/tcpdump_man.html

That should get you on your way. Apart from that, it's being creative
with what is offered by the libpcap filter format.

Cheers,
    Sake