Re: a question on capture filter

[Guy Harris <guy () alum mit edu>]

On Sep 24, 2012, at 12:32 PM, Guy Harris <guy () alum mit edu> wrote:

> Try
>
>       host 138.56.169.25 and (not host 138.52.69.45) and (not udp port ntp) and (not igmp)

And "host XXX" also checks for ARP packets (by looking at the protocol source and destination addresses); "ip host XXX" 
checks only the IPv4 source and destination addresses, so

        ip host 138.56.169.25 and (not ip host 138.52.69.45) and (not udp port ntp) and (not igmp)
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe