Ask Your Question

How to capture UDP traffic and not NBNS traffic?

asked 2018-01-02 17:29:22 +0000

mzimmers gravatar image

updated 2018-01-02 18:53:31 +0000

Guy Harris gravatar image

Hi -

I'm sure this question has been asked and answered many times, but I can't find what I'm looking for.

I'm trying to apply filters so I only see traffic between two devices, and only when they're of UDP protocol. In the display filter, I use this:

(ip.addr == || ip.src ==

and in Capture->Options, I've selected the (presupplied) udp filter. I'm still seeing traffic of other protocols, though. Can someone tell me what I'm doing wrong? Thanks.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2018-01-02 18:51:59 +0000

Guy Harris gravatar image

The protocol I'm seeing that I don't wish to is NBNS.

NBNS runs atop UDP, on port 137, so a capture filter that captures only UDP traffic, and doesn't capture UDP traffic that's NBNS traffic, would be udp && !udp port 137.

edit flag offensive delete link more


Beautiful. That helps a lot. Thanks...I'd upvote you if I could.

mzimmers gravatar imagemzimmers ( 2018-01-02 18:56:52 +0000 )edit

@mzimmers If this is the correct answer for you, you should be able to click the checkmark indicating so.

Jaap gravatar imageJaap ( 2018-01-03 06:52:59 +0000 )edit

@Jaap: done, and thanks.

mzimmers gravatar imagemzimmers ( 2018-01-03 15:02:19 +0000 )edit

answered 2018-01-02 17:39:34 +0000

updated 2018-01-02 17:40:28 +0000

The pipes (||) are a logical "or" so your filter says anything to/from or from You will want to use two ampersands (&&).

(ip.addr == && ip.src ==

This will only be one direction though (sourced from .22). You might want to use ip.addr for both statements to get bidirectional traffic.

(ip.addr == && ip.addr ==

The UDP capture filter should limit it to only UDP packets. Are you sure you aren't just seeing the other protocols that rely on UDP for transmission, such as DNS?

edit flag offensive delete link more


Thanks for the response. The protocol I'm seeing that I don't wish to is NBNS. The communication between the two devices is socket-based; perhaps there's a way to filter based on the socket number or something?

mzimmers gravatar imagemzimmers ( 2018-01-02 18:20:12 +0000 )edit

Try this: (ip.addr == && ip.addr == && !nbns

csereno gravatar imagecsereno ( 2018-01-02 18:42:28 +0000 )edit

You can also filter on port number (socket) such as:

(ip.addr == && ip.addr == && tcp.port==##

Whatever that port number is in this case

csereno gravatar imagecsereno ( 2018-01-02 18:43:37 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-01-02 17:29:22 +0000

Seen: 21,084 times

Last updated: Jan 02 '18