more

[metze/wireshark/wip.git] / dfilters

diff --git a/dfilters b/dfilters
index cb7aded1a1305759b7c5dd57a1942c7ab1601dad..5a89fafac701099ffaff90ad2ec8de28e1dac4ac 100644 (file)
--- a/dfilters
+++ b/dfilters
@@ -1,15 +1,16 @@
-"Ethernet address 00:08:15:00:08:15" eth.addr == 00:08:15:00:08:15
+"Ethernet address 00:00:5e:00:53:00" eth.addr == 00:00:5e:00:53:00
 "Ethernet type 0x0806 (ARP)" eth.type == 0x0806
 "Ethernet broadcast" eth.addr == ff:ff:ff:ff:ff:ff
 "No ARP" not arp
-"IP only" ip
-"IP address 192.168.0.1" ip.addr == 192.168.0.1
-"IP address isn't 192.168.0.1, don't use != for this!" !(ip.addr == 192.168.0.1)
-"IPX only" ipx
+"IPv4 only" ip
+"IPv4 address 192.0.2.1" ip.addr == 192.0.2.1
+"IPv4 address isn't 192.0.2.1 (don't use != for this!)" !(ip.addr == 192.0.2.1)
+"IPv6 only" ipv6
+"IPv6 address 2001:db8::1" ipv6.addr == 2001:db8::1
 "TCP only" tcp
 "UDP only" udp
 "Non-DNS" !(udp.port == 53 || tcp.port == 53)
 "TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80
 "HTTP" http
 "No ARP and no DNS" not arp and !(udp.port == 53)
-"Non-HTTP and non-SMTP to/from 192.168.0.1" not (tcp.port == 80) and not (tcp.port == 25) and ip.addr == 192.168.0.1
+"Non-HTTP and non-SMTP to/from 192.0.2.1" ip.addr == 192.0.2.1 and not tcp.port in {80 25}