Wireshark · Ethereal-users: [ethereal-users] How to set capture filter for IPX and NCP (Novell)?

[Jeff Johnson <jeff@xxxxxxx>]

Hello,

	Can anyone tell me how to setup capture filters to only pickup IPX/NCP
packets? Here is detail of the packets I wish to capture. I dont care about ipx
or ethernet src and dest as I want to capture all of said packets within the
collision domain. I tried looking at the man pages and source for tcpdump and
libpcap but there is little or no IPX filter tags that I could find reference
to. From looking at raw captures of all packets it looks like I want to capture
all IPX/NCP packets with a ncp function code of 0x15. Any help in building a
capture filter (so I dont capture all IP/IPX packets and stuff my disk) would
be very much appreciated!

Thanks,

Jeff

Frame (84 on wire, 84 captured)
    Arrival Time: Nov  1, 1999 17:25:01.2183
    Time delta from previous packet: 0.000480 seconds
    Frame Number: 10435
    Packet Length: 84 bytes
    Capture Length: 84 bytes
IEEE 802.3 
    Destination: 00:60:97:14:76:1d (00:60:97:14:76:1d)
    Source: 00:a0:24:aa:d8:d5 (00:a0:24:aa:d8:d5)
    Length: 70
Logical-Link Control
    DSAP: NetWare (0xe0)
    SSAP: NetWare (0xe0)
    Control field: U, func = UI (0x03)
        000. 00.. = Unnumbered Information
        .... ..11 = Unnumbered frame
Internetwork Packet eXchange
    Checksum: 0xffff
    Length: 67 bytes
    Transport Control: 0 hops
    Packet Type: NCP (0x11)
    Destination Network: 0x00000001
    Destination Node: 00:00:00:00:00:01 (00:00:00:00:00:01)
    Destination Socket: NCP (0x0451)
    Source Network: 0x4E272135
    Source Node: 00:a0:24:aa:d8:d5 (00:a0:24:aa:d8:d5)
    Source Socket: Unknown (0x400C)
NetWare Core Protocol
    Type: Service request
    Sequence Number: 164
    Connection Number: 53
    Task Number: 36
    Function Code: 0x15 ()