You may be having the same confusion I had in using the Ethereal Filter setup window- It is not what I would call intuitive.
1. Bring up the Ethereal Filters window
2. Enter a Name- overwrite whatever is there if necessary- Ex Port20K Only
3. Enter the filter string- Ex tcp.port==20000
4. Now press New button
5. Press Save ? Not sure but just in case.
Now you have a filter named Port20K Only
The trick is to fill in the blanks and then hit New- opposite of what I expected.
JohnW
-----Original Message-----
From: R.K. SUBRAMANIAN [SMTP:subramanian.rk@xxxxxxxxxxxxxxxx]
Sent: Tuesday, April 25, 2000 9:53 PM
To: Guy Harris
Cc: ethereal-users@xxxxxxxx
Subject: Re: [ethereal-users] help please.
thanx Guy, thanx John for the prompt response.
Guy, What I mean to say is -- I m not able to use the Filter Preferences
in the pop-down menu of ethereal GUI. I am not able to create a new filter
from that option. However, I am able to use filters using the pane below
the hex dump pane.
regards,
Subramanian
On Tue, 25 Apr 2000, Guy Harris wrote:
> > i downloaded ethereal for Red Hat Linux 6.1. I followed the instructions
> > to install it and ethereal ran well. However, I am not able to configure
> > filters.
>
> What do you mean by "I am not able to configure filters"?
>
> Do you mean that when you try to specify a capture filter it reports an
> error?
>
> If so, note that the man page does *not* describe the syntax of capture
> filters, it just says that
>
> Packet capturing is performed with the pcap library. The
> capture filter syntax follows the rules of the pcap library.
> This syntax is different from the display filter syntax.
>
> and later says:
>
> CAPTURE FILTER SYNTAX
> See manual page of tcpdump(8).
>