Ethereal-users: Re: [ethereal-users] How can I filter Bootp and STP?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 3 Aug 2000 17:29:40 -0700 (PDT)
> Even though Ethereal recognises STP and BOOTP as protocols there is no way
> to say for example not proto bootp. Is there a way other than using specific
> ip addresses and tcp ports?

Well, STP doesn't run atop IP, so you can't filter for it with IP
addresses or TCP ports; see

	http://ethereal.zing.org/lists/ethereal-users/200007/msg00148.html

for the ways to filter for STP in programs using libpcap (e.g., tcpdump,
Ethereal, etc.).

For BOOTP, you have to filter on a specific *UDP* port (BOOTP runs atop
UDP) - that's how Ethereal recognizes BOOTP - but you can probably do

	udp port bootps

("s" in "bootps" stands for "server"; the "/etc/services" file on
Solaris 2.6, at least, has a separate "bootpc" for the client), but, if
that filter is rejected, try

	udp port 67