Re: Need filters

[Guy Harris <guy () alum mit edu>]

On Jun 22, 2010, at 2:44 PM, David H. Lipman wrote:

> I attached two PCAP files in a ZIP file with data that we do NOT need to 
> see in a resultant report.

dump.pcap and dump1.pcap have a bunch of NBNS traffic; try the filter "not udp port 137".  That's not SMB - that's 
either TCP port 139 or TCP port 445, possibly with some UDP port 138 stuff, too, so "not udp port 137" should filter 
out the stuff in your two capture files without filtering out SMB traffic.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe