 | 1 | initial version |
You didn't specify if you wanted a capture filter or Wireshark display filter, but it's possible either way, albeit with different syntax.
For the capture filter, you can use portrange 21100-21299, and you can refer to the pcap-filter man page for more information on capture filters.
For the display filter, you'd use something like tcp.port >= 21100 && tcp.port <= 21299, and keep in mind here that port in this context refers to either the source port or the destination port. Alternatively, and more succinctly, you could use the membership operator as in, tcp.port in {21100 .. 21299.
NOTE: Replace tcp with udp if that's the transport applicable for your use case.
For more information on Wireshark display filters, refer to the wireshark-filter man page.
| | 2 | No.2 Revision |
You didn't specify if you wanted a capture filter or Wireshark display filter, but it's possible either way, albeit with different syntax.
For the capture filter, you can use portrange 21100-21299, and you can refer to the pcap-filter man page for more information on capture filters.
For the display filter, you'd use something like tcp.port >= 21100 && tcp.port <= 21299, and keep in mind here that port in this context refers to either the source port or the destination port. Alternatively, and more succinctly, you could use the membership operator as in, tcp.port in {21100 .. .2129921299}
NOTE: Replace tcp with udp if that's the transport applicable for your use case.
For more information on Wireshark display filters, refer to the wireshark-filter man page.
