Ethereal-users: Re: [Ethereal-users] Capture Filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 9 Mar 2004 13:29:13 -0800 (PST)
McCabe, Mike said:
> I have Win32 eithereal installed on a W2K laptop.  How would I setup a
> capture filter to only capture the first 128 bytes of each packet so I
> don't capture the payload?

You can't.  That "packet-slicing" function is *NOT* implemented by capture
filters.  Capture filters control which packets are captured, not how much
of the packet is captured.

Instead, you turn on the "Limit each packet to [...] bytes" option in the
capture dialog, and put "128" into the field.

Note that the length in question is the *full* length of the packet,
including link-layer headers.