Wireshark-users: Re: [Wireshark-users] filter for snmp doesn't work (also shows ICMP???)
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Jim Young" <SYSJHY@xxxxxxxxxxxxxxx>
Date: Wed, 05 Mar 2008 12:57:31 -0500
>>> "Jim Young" <SYSJHY@xxxxxxxxxxxxxxx> 03/05/08 12:39 PM >>>
>>> <leonardo.lagos@xxxxxxxxxxxxxxxxxxxxxxx> 03/05/08 12:07 PM >>>
>> Hi,
>> 
>> I have a capture file where I have added the following filter:
>> 
>> ip.proto==0x11 and udp.port==162
>> 
>> This filter works, and show my SNMP traps, but also shows an ICMP 
> packet.. However, ip.proto for ICMP is 0x01, not 0x11....
>> 
>
>
> If you really do NOT want to see these ICMP packets then you could 
> append a "and !snmp" to your filter.

Doh!  Sorry make that:

"... append a "and !icmp" to your filter."

Jim Y.