Ethereal-users: Re: [Ethereal-users] capture filter and greater than operand

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 14 Jul 2005 09:30:42 -0700
John Que wrote:


When with conjunction with another  than qualifier - it does ***NOT*** work.
like udp[2:2] > 8000 and udp[2:2] <8010 or (udp[2:2] > 8000 and udp[2:2] <8010) or ( (udp[2:2] > 8000) and (udp[2:2] <8010) ) 

I don't have a clue why joining both conditions does not work.
What does "ethereal -v" print? Some versions of libpcap - including all the 0.8[.x] releases - had a bug that caused expressions of that sort not to work; that bug is fixed in libpcap 0.9[.x]. (0.9[.x] also supports the "portrange" operator, so you can do "udp portrange 8001-8009" in applications that are using libpcap 0.9[.x].)