Re: [Ethereal-users] Sniffer Pro vs Ethereal

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Sep 03, 2001 at 12:46:19PM +0800, Visser, Martin (SNO) wrote:
> Unfortunately Ethereal can't quite do this either. So, please write the code
> to do this!(it has been noted more than once on the development list that
> this feature is needed.)

Are you talking about capture filters or display filters?

For capture filters, there's no convenient syntax offered by libpcap at
present, but you can do something such as

	ip[12:4] & 0xffffff00 == 0x0a0a0a00

to check for source addresses in 10.10.10.0/24, and something such as

	ip[16:4] & 0xffffff00 == 0x0a0a0a00

to check for destination addresses in 10.10.10.0/24, so to test for
packets either coming from or going to that network, do

(ip[12:4] & 0xffffff00 == 0x0a0a0a00) || (ip[16:4] & 0xffffff00 == 0x0a0a0a00)

For display filters, we now support CIDR-style addresses in filters, so

	ip.addr == 10.1.2.0/24

should match packets coming from or going to the 10.1.2.0/24 network.