Wireshark · Ethereal-users: Re: [Ethereal-users] Filtering based on netbios/netbeui

[Guy Harris <guy@xxxxxxxxxx>]

> I have been trying to find documentation on how to 
> filter out packets based only on the hostname of a
> failed windows netlogon but has been unsuccessful. 
> Specifically, I set display filter to: 
> netlogon.computer_name == "some-windows-hostname" 

I.e., if you have a capture in which a Netlogon packet has some name in
the "Computer Name" field, and you try filtering on that name with that
expression, it doesn't find that packet?

That sounds like a bug.  Could you send us one of those capture files
(or, at least, a capture file containing only that packet; you could
mark the packet with "Mark Frame" from the "Edit" menu, and then do a
"Save As..." from the "File" menu, and set the "Save only marked
packets" button)?