[Kris Boulez <krbou@xxxxxxxxxx>]

Quoting Guy Harris (guy@xxxxxxxxxx):
> > I must admit that the difference between capture and display filters is
> > one of the reasons I'm still a bit reluctant to use [t]ethereal (which
> > is a great tool BTW).
> > What are/were the reasons to have those different filter syntaxes.
> 
> The reason for using tcpdump/libpcap syntax for capture filters was that
> it was already there, and code generation for BPF is a non-trivial task.
> 
> The reason for *not* using tcpdump syntax for display filters is that
> it's not general enough.
> 
It's just that people like me who have used tcpdump and friends to
diagnose their netwerk problems, find themself confronted with a second
filter language to learn.
But as it is a tool which enables me to look at things with much more
detail then tcpdump, this will be the price we'll have to pay.

Kris,