On Wed, Feb 06, 2008 at 10:14:29PM +0100, Sake Blok wrote:
> On Wed, Feb 06, 2008 at 02:46:21PM -0500, James Pifer wrote:
> >
> > I would also like to filter NBNS protocol. Right now I have a display
> > filter like this:
> > nbns.flags == 0x2810 || nbns.flags == 0x2910
> >
> > Again, I'd rather have this in a capture filter in case I want to start
> > saving it.
>
> You could use something like:
>
> udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910
Oops, that should of course be:
"udp port 137 and (udp[0xa:2] == 0x2810 || udp[0xa:2] == 0x2910)"
Cheers,
Sake
