Ethereal-users: Re: [Ethereal-users] Protocol filtering...question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Walter <walter@xxxxxxxxxxxx>
Date: Wed, 08 Aug 2001 22:44:42 +1000
> Here's the various ways I tried entering the filter 
> (without quotes): "proto tcp" or "ip proto tcp" or 
> "ip|ether proto tcp". [...snip...] Any suggestions?

tcp
ip proto \tcp   <-- or \\ if you need to escape \ 
                    from your shell!
ip proto 6      <-- ip protocol # of tcp

I suggest you 'man tcpdump' - it has a better
description of the libcap capture rule format.

- walter