Hello Marco, Can you please tell me which version of ethereal and winpcap you are using?. I have already tried what you have suggested. But it is not working. Only suspection is on version of ethereal and winpcap.
Please tell me the version of winpcap and ethereal. thanks Vadiraj Kulkarni -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Marco van den Bovenkamp Sent: Thursday, February 19, 2004 7:12 PM To: Ethereal user support Subject: Re: [Ethereal-users] how to capture only DNS packets byapplyingfilterin ethereal? Moses Hernandez wrote: > The reason you don't see the DNS response is because DNS will not respond > back on port 53 it will only listen on that port for incoming requests. DNS requests are sent *to* port 53 on the server (where it listens), and the replies are sent *from* port 53. 'udp port 53' as capture filter (which matches either source or destination port or both being 53) should capture both requests and replies, and does so for me. I can't explain why it doesn't work for him. Perhaps he could try just 'port 53', capturing both UDP & TCP? The server shouldn't use TCP (although the client *might*), but that's all I can think of. 'dns' is not valid *capture* filter syntax; it's a display filter. -- Regards, Marco. _______________________________________________ Ethereal-users mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-users _______________________________________________ Ethereal-users mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-users
