Antonio Perez wrote: > which both work on port 80, filter the destination port 80 and compare. > hint: tcp.dstport==80
also you may add the dest IP or any other relevant factor to reduce noise: for wget http://www.google.com : tcp.dstport==80 and ip.addr==74.125.159.1/24 for http://www.livecdlist.com: tcp.dstport==80 and ip.addr==74.81.93.114 Note: google.com site resolves to several addresses, so a /24 range will cover all of them. -- Antonio Perez -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
