Ethereal-users: Re: [Ethereal-users] Filterquestion: Checksum

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Thu, 1 Jul 2004 12:20:59 -0700 (PDT)
Uli Korn said:
> i need a capturefilter which only capture packets with a bad checksum.

Unfortunately, you can't get what you need - BPF (the filtering engine
used for capturing) doesn't support that.

You could try capturing with Tethereal using a "read filter", which lets
you use a display filter when capturing - but note that display filters
require more CPU to evaluate, *and* don't stop packets from being copied
from OS kernel buffers to Ethereal's buffers (unlike capture filters,
which, on some platforms, are interpreted by a BPF interpreter in the
kernel, so packets that don't pass the filter are discarded rather than
being copied to userland and filtered there).