<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Book Antiqua; MARGIN-LEFT: 2px">
<DIV>Thanks Luke, again much appreciated.</DIV>
<DIV> </DIV>
<DIV>Jon</DIV>
<DIV> </DIV>
<DIV>Jon L. Miller, MCNE, CNS, ASE<BR>Director/Sr Systems Consultant<BR>MMT
Networks Pty Ltd<BR><A
href="http://www.mmtnetworks.com.au">http://www.mmtnetworks.com.au</A></DIV>
<DIV> </DIV>
<DIV>"I don't know the key to success, but the key to failure<BR> is trying
to please everybody." -Bill Cosby</DIV>
<DIV> </DIV>
<DIV><BR><BR>>>> ldlist@westnet.com.au 3:56:54 pm 25/05/2004
>>><BR>In tcpdump, I don't think there's actually any specific filter
options <BR>that will let you do this. However, the filters _will_ let you delve
<BR>into the data inside a packet. So you can look at the source and
<BR>destination port fields of the TCP header, and evaluate that. These
<BR>fields are both two bytes long and sit at byte offset 0 and 2,
<BR>respectively. You'll need to do some hex conversions and bit
masking<BR><BR>If you're interested in ports greater than 4096,<BR>4096 decimal
= 0x1000<BR><BR>Source port greater than 4096:<BR># tcpdump -s0 -n 'tcp[0:2]
& 0xffff > 0x1000'<BR><BR>Destination port greater than 4096:<BR>#
tcpdump -s0 -n 'tcp[2:2] & 0xffff > 0x1000'<BR><BR>Either source or
destination port greater than 4096:<BR># tcpdump -s0 -n '(tcp[0:2] & 0xffff
> 0x1000) or (tcp[2:2] & 0xffff >
<BR>0x1000)'<BR><BR>Cheers<BR>Luke<BR><BR><BR>Jon Miller wrote:<BR><BR>>Like
to know if there is a way to have either tcpdump or tethereal display ports
greater than a certain number instead of putting in each port
separately?<BR>><BR>>Thanks<BR>><BR>><BR>><BR>>Jon L. Miller,
MCNE, CNS, ASE<BR>>Director/Sr Systems Consultant<BR>>MMT Networks Pty
Ltd<BR>><A
href="http://www.mmtnetworks.com.au">http://www.mmtnetworks.com.au</A><BR>><BR>>"I
don't know the key to success, but the key to failure<BR>> is trying to
please everybody." -Bill Cosby<BR>>
<BR>><BR>>------------------------------------------------------------------------<BR>><BR><BR>_______________________________________________<BR>PLUG
discussion list: plug@plug.linux.org.au<BR><A
href="http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug">http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug</A><BR>Committee
e-mail: committee@plug.linux.org.au<BR><BR></DIV></BODY></HTML>