Packet captures on port ranges

[DBCK]

Hi all,

i'm sure there was a filter expression with the Meraki packet captures to capture a range of ports, can anybody confirm the expression required to capture a range, for example lets say i want to capture only Microsoft teams audio i would want to filter on this port range,

50,000-50,019

expression, "port range 50000 to 50019" is what i would logically assume but is not correct, can anyone advise.

Thanks

[KarstenI · Accepted solution]

You can use the option portrange 50000-50019 for this (without a space and using a dash).

[DBCK]

Thanks Karstenl, something so simple but works as it should thanks for your response

[KarstenI]

Well, it's not always that simple and at least my tcpdump expressions also not always work on the first try ... 🙂

[PhilipDAth]

Pro tip; capture far more than you want, and then limit it in Wireshark afterwards using a display filter.

For example, I'd be tempted to use a capture filter of something like "udp" to capture all UDP traffic, and then narrow it down afterwards.

Often you'll find something unusual and want to see what else was happening around that time, or was there some other trigger, and you want to be able to just see those extra packets without doing another capture.

[DBCK]

Thanks Philip, the problem i had with that is Meraki limits the duration to 1200 seconds (20minutes) or 100,000 packets and even filtering on UDP it runs for around 25 seconds and ive hit the 100,000 packets allready which is why i needed a more specific expression for the range i was looking at.