THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

What's a display filter that only shows packets with a particular UDP source port number?

  • retag add tags

I'm looking at a UDP capture for a command prompt inquiry where I released my current IP address and then renewed it. Even with the UDP filter, there's still a lot of data packets to go through so I need to apply a second filter that will only show the UDP source port number of the client. Any ideas on how to do that? I've Googled it a few times but can't find the exact filter I would need. Any help would be greatly appreciated. Thanks!

ohh_bnertt12312's avatar
1
ohh_bnertt12312
asked 2020-03-09 15:14:01 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2020-03-09 18:12:59 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

If you only want to see packets with a particular UDP source port value, that would be "udp.srcport == <value>". where "<value>" is the port number value.

That will, however, only show packets from the client, not packets to the client. If you want to see packets from and to that port, that would be "udp.port == <value>".

Guy Harris's avatar
19.9k
Guy Harris
answered 2020-03-09 18:12:48 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer