Wireshark · Ethereal-dev: Re: [ethereal-dev] Syntax for capture filter (Truth in advertising?)

[Ben Fowler <wapdev@xxxxxxxxxxxx>]

At 08:56 AM 6/19/00, Guy Harris wrote:
> On Mon, Jun 19, 2000 at 07:31:50AM +0100, Ben Fowler wrote:
> > That is very helpful. I saw this note (earlier) and restarted ethereal
> > to try again before posting; but it still didn't work.
>
> If it doesn't work, then either
>
>         1) Ethereal isn't linked with the same version of libpcap that
>            tcpdump is, and the version of libpcap with which it's linked
>            has a bug in its capture-filter parser
>
> or
>
>         2) somehow your version of Ethereal isn't passing the filter
>            string correctly to "pcap_compile()" in libpcap


The operative cause of the problem was that I had
      tcp port 80 OR tcp port 3128
in the filters dialogue, and this was sufficient to
prevent the filter working, without unfortunately alerting
me to the problem

Since compatibility with tcpdump is a useful feature and starting
point, I am not suggesting that case sensitivity be changed;
but it might be an idea to add a note in the documentation,
as upper case for logical operators seems natural.

Ben.



--
Leedsnet - The information resource for Leeds and the West Riding
< URL:http://www.leedsnet.com/mobile/ >