This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tcpdump filter to find only certain hosts

0

I've been trying to come up with a tcpdump filter to find all IPv4 hosts that fit x.x.x.35 - I just need to see packets that are hosts ending in .35 and I don't care about the network numbers.

asked 01 Oct '14, 04:16

James%20Steinmetz's gravatar image

James Steinmetz
16●1●1●3
accept rate: 0%

One Answer:

0

See here for some advanced filters, but basically you need to slice the ip header in the correct spot:

-f "ip[15] = 35 or ip[19] = 35"

quote as required for your shell.

answered 01 Oct '14, 04:50

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206
accept rate: 22%

That did the trick and will help me continue to learn the more complex filter methods - THANK YOU.

(01 Oct '14, 04:58) James Steinmetz

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(01 Oct '14, 05:10) grahamb ♦