On Tue, Jun 13, 2000 at 10:51:03AM -0500, Ruhland, Paul wrote:
>
>
> No matter what I type as the filter ( Capture...Start..) I get an "Unable
> to
> parse filter string (parse error)" message. Yes, I have looked at the
> tcpdump manual ( I use tcpdump often ) and still cannot figure out how to
> get the filters to work in ethereal. Even the example you give in the man
> pages for ethereal fails with the same error message.
>
> Do you have any updated references for this? Could you show me an example
> of how to filter for a specific host on telnet port?
Because of a deficiency in the libpcap code (it doesn't reset it's scanner),
if you make a syntax error in a capture filter, any other capture filter
after that will fail. You have to restart Ethereal to use another
capture filter.
A sample capture filter:
host XXX and tcp port 23
--gilbert