Re: Masquerading problems: squeeze via lenny

[Antonio Perez <ap23563m@gmx.com>]

Antonio Perez wrote:

> which both work on port 80, filter the destination port 80 and compare.
> hint: tcp.dstport==80

also you may add the dest IP or any other relevant factor to reduce noise:

for wget http://www.google.com :
	tcp.dstport==80 and ip.addr==74.125.159.1/24

for http://www.livecdlist.com:
	tcp.dstport==80 and ip.addr==74.81.93.114


Note: google.com site resolves to several addresses, so a /24 range will 
cover all of them.


-- 
Antonio Perez