On Dec 1, 2009, at 12:46 PM, Boaz Galil wrote:
We are using old version of winpcap. In any case we are sure that
there is traffic between this range (as we are getting in -
wireshark without any filter).
Download windump, if you haven't done so already, and then do
windump -d "host x.x.x.x and ((udp [2:2] >= 20 and udp [2:2] <= 80)
or (udp [0:2] >= 20 and udp [0:2] <= 80))"
(where "x.x.x.x" is the IP address you used).
Then do a Wireshark/TShark capture without a filter, save it to a
file, and then try
windump -r {the file name} "host x.x.x.x and ((udp [2:2] >= 20 and
udp [2:2] <= 80) or (udp [0:2] >= 20 and udp [0:2] <= 80))"
and see if it reports anything.
