osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Add IPv6 examples to capture/display filters 

Also use TEST-NET-1 for IPv4 examples.

Replaced note using comma with parentheses

Change-Id: I9855207aec7a335b80986aa63bd235edc4278d3a
Reviewed-on: https://code.wireshark.org/review/10061
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
This commit is contained in:
João Valverde 2015-08-16 21:02:35 +01:00 committed by Hadriel Kaplan
parent fc1b48f46b
commit 8352ff1cc5
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfilters
View File

@ -2,8 +2,10 @@
"Ethernet type 0x0806 (ARP)" ether proto 0x0806
"No Broadcast and no Multicast" not broadcast and not multicast
"No ARP" not arp
"IP only" ip
"IP address 192.168.0.1" host 192.168.0.1
"IPv4 only" ip
"IPv4 address 192.0.2.1" host 192.0.2.1
"IPv6 only" ip6
"IPv6 address 2001:db8::1" host 2001:db8::1
"IPX only" ipx
"TCP only" tcp
"UDP only" udp

10
dfilters
View File

@ -2,9 +2,11 @@
"Ethernet type 0x0806 (ARP)" eth.type == 0x0806
"Ethernet broadcast" eth.addr == ff:ff:ff:ff:ff:ff
"No ARP" not arp
"IP only" ip
"IP address 192.168.0.1" ip.addr == 192.168.0.1
"IP address isn't 192.168.0.1, don't use != for this!" !(ip.addr == 192.168.0.1)
"IPv4 only" ip
"IPv4 address 192.0.2.1" ip.addr == 192.0.2.1
"IPv4 address isn't 192.0.2.1 (don't use != for this!)" !(ip.addr == 192.0.2.1)
"IPv6 only" ipv6
"IPv6 address 2001:db8::1" ipv6.addr == 2001:db8::1
"IPX only" ipx
"TCP only" tcp
"UDP only" udp
@ -12,4 +14,4 @@
"TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80
"HTTP" http
"No ARP and no DNS" not arp and !(udp.port == 53)
"Non-HTTP and non-SMTP to/from 192.168.0.1" not (tcp.port == 80) and not (tcp.port == 25) and ip.addr == 192.168.0.1
"Non-HTTP and non-SMTP to/from 192.0.2.1" not (tcp.port == 80) and not (tcp.port == 25) and ip.addr == 192.0.2.1