Ethereal-users: Re: [Ethereal-users] Newbie question about capture filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 7 Aug 2001 01:20:21 -0700
On Tue, Aug 07, 2001 at 10:10:37AM +0200, hans.verbeek@xxxxxxxxxxx wrote:
> The syntax for that version is like you indicated:
> a) h225
> b) h225 || h245

That'd be the *display* filter syntax for it in the H.323-enhanced
version of Ethereal.

However, there is, as noted, no *capture* filter syntax for it (the
capture filter syntax is not defined by Ethereal, it's defined by
libpcap - and limited by the BPF engine that libpcap and many OS kernels
use, so there are limits on what Ethereal would be able to do in a
capture filter even if it had its own parser).