Ethereal-users: Re: [ethereal-users] capture filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 17 Nov 1999 15:37:49 -0800 (PST)
> I keep seing reproductions off the tcpdump manpage (I use tcpdump just
> fine) in answer to capture filter questions. However I get parse errors
> from etheral even when using a tcpdump command line which works

There's a bug in "libpcap" that can cause parses of valid filter
expressions to fail if, prior to that, a parse failed - for example, if
you enter an invalid filter in the Capture/Start window, subsequent
filters may fail even if they're valid.  That's not an issue for
"tcpdump", as it only parses one filter within one invocation of
"tcpdump", but it *is* an issue for Ethereal.

Did you get parse errors on the *first* expression you tried?

I just tried

	port 53

on an Ethereal here, and it did, in fact, capture only DNS packets.