Wireshark-users: Re: [Wireshark-users] Capture Filter Help

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 6 Feb 2008 22:20:23 +0100

On Wed, Feb 06, 2008 at 10:14:29PM +0100, Sake Blok wrote:
> On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote:
> > 
> > I would also like to filter NBNS protocol. Right now I have a display
> > filter like this:
> > nbns.flags == 0x2810 || nbns.flags == 0x2910
> > 
> > Again, I'd rather have this in a capture filter in case I want to start
> > saving it.
> 
> You could use something like:
> 
> udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910

Oops, that should of course be:

"udp port 137 and (udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910)"

Cheers,
   Sake