Ethereal-users: Re: [Ethereal-users] [U] dhcp OPTIONS filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Tue, 25 Apr 2006 18:01:24 +0200 (CEST)
Hi,

First make sure your version of Ethereal has been linked with PCRE (see
menu option Help|About Ethereal. It says something like: "...with libz
1.2.3, with libpcre 6.4, with Net-SNMP 5.2.2, with ADNS....". It has to
say "with libpcre".

Then enter this display filter expression:
bootp contains RRAS.Microsoft

Thanx,
Jaap

On Tue, 25 Apr 2006, Baker Garry L CIV Raytheon 72nd Sig BN IANE wrote:

> I need to create a filter to look for a RAS server running on W2K
>
> "Windows 2000 RAS packets have the string, RRAS.Microsoft, hardcoded
> into the dhcp-user-class-id field."
>
> Dhcp-user-class-id is OPTION number 77
>
> I just do not clearly understand the filter syntax in Ethereal to seach
> for RRAS.Microsoft
>
> Can someone please enlighten me on what this filter might look like? I
> assume this will be a display expression and cannot be a capture
> filter...