Re: Yum install centos 5.2

[Guy Harris <guy () alum mit edu>]

On Oct 11, 2009, at 2:28 PM, Mike Brandonisio wrote:

> Since tshark appears to work I'm trying to record HELOs/EHLOs for a  
> specific IP, the value of the HELOs/EHLOs.
>
> I have this so far:
>
> tshark -f "port 25" -R "ip.src==74.xx.xx.xx"

I'd try

        tshark -f "port 25 and src host 74.xx.xx.xx"

which will do all the filtering in libpcap/the kernel.

However, if the HELO/EHLOs are coming on port 587 rather than port 25,  
try

        tshark -f "port 587 and src host 74.xx.xx.xx".

I'm assuming here that the HELOs/EHLOs are coming *from* 74.xx.xx.xx;  
if not, try

        tshark -f "port 587 and dst host 74.xx.xx.xx"
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe