Ethereal Capture Filter for DEC Traffic

How to make an Ethereal packet capture filter for DEC traffic.

One of the great strengths of Ethereal is its very powerful filtering language. This document describes some of its features specifically the use of primitives.

You can build packet capture filters and reuse them at any time. Take a look at Ethereal Setting Capture Filters for a description of how to make and reuse a simple filter.

Once you have mastered making a simple filter you can try some of the more advanced ones described in Ethereal Advanced Packet Capture Filtering.

Capturing specific DECNET Host traffic

DECNET uses a particular form of host addressing, in the format 10.123. A primitive exists to allow you to capture packets involving DECNET addresses.

You may use host names or IP Addresses. So if the machine is 10.123, in the Filter string, entering:

decnet host 10.123 will capture packets to and from the address.

Optionally you may specify if the address is a destination or a source address.

decnet dst host 10.123 will capture only traffic to the address.

Optionally you may specify if the address is a destination or a source address.

decnet src host 10.123 will capture only traffic from the address.

Capturing specific Ether type traffic

Primitives exist for capturing specific Ether types.

In the Filter string, entering:

ether proto decnet is the same as ether proto 6003 and will capture all DECNET packets.

In the Filter string, entering:

ether proto lat is the same as ether proto 6004 and will capture all DEC LAT packets.

In the Filter string, entering:

ether proto moprc is the same as ether proto 6002 and will capture all MOP RC packets.

In the Filter string, entering:

ether proto mopdl is the same as ether proto 6001 and will capture all MOP DL packets.

To perform filtering on IP hosts and related protocols go to Filtering IP Traffic.

To perform filtering on Ethernet hosts and protocols go to Filtering MAC Traffic.

For a description of even more options go to Filtering while capturing.