Ethereal-dev: Re: [ethereal-dev] Syntax for capture filter (Truth in advertising?)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Mon, 19 Jun 2000 00:56:50 -0700
On Mon, Jun 19, 2000 at 07:31:50AM +0100, Ben Fowler wrote:
> That is very helpful. I saw this note (earlier) and restarted ethereal
> to try again before posting; but it still didn't work.

If it doesn't work, then either

	1) Ethereal isn't linked with the same version of libpcap that
	   tcpdump is, and the version of libpcap with which it's linked
	   has a bug in its capture-filter parser

or

	2) somehow your version of Ethereal isn't passing the filter
	   string correctly to "pcap_compile()" in libpcap

as both tcpdump and Ethereal (and Tethereal as well) use libpcap's
"pcap_compile()" to parse capture filters, so if the filter string is
passed correctly by Ethereal, and the libpcap libraries with which
tcpdump and Ethereal are linked are the same, tcpdump and Ethereal
should parse capture filters in the *exact* same fashion.