Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-users: [Wireshark-users] UDP port range in Tshark

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: Boaz Galil <boaz20@xxxxxxxxx>
Date: Tue, 1 Dec 2009 19:26:14 +0200

Hi Experts,

I want to run Tshark command that will capture packets according to port range.

When I am using the filter " -f "host x.x.x.x and ((tcp [2:2] >= 20 and tcp [2:2] <= 80) or (tcp [0:2] >= 20 and tcp [0:2] <= 80))" I am capturing the TCP packets with no problems.

The problem is when I want to use the same command for UDP e.g : “" -f "host x.x.x.x and ((udp [2:2] >= 20 and udp [2:2] <= 80) or (udp [0:2] >= 20 and udp [0:2] <= 80))" I am not getting any error but I am also not getting any results inside the packet capture file.

--
Boaz.

Follow-Ups:
- Re: [Wireshark-users] UDP port range in Tshark
  - From: Guy Harris

Next by Date: [Wireshark-users] question about exporting/filtering files
Next by thread: Re: [Wireshark-users] UDP port range in Tshark
Index(es):
- Date
- Thread