Wireshark-users: Re: [Wireshark-users] Capture Filter Everything
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 28 Sep 2011 11:53:22 -0700
On Sep 28, 2011, at 11:38 AM, Chuck B wrote:

> At the moment I am less interested in the ports used as I am in identifying the servers that the app connects to. Once I identify all the servers I figure it should be possible to create a filter that excludes all but those servers.

If by "servers" you're referring to particular machines, you should be able to construct a capture filter of the form "host XXX or host YYY or host ZZZ" once you know those machines' host names or IP addresses.