Ethereal-users: [Ethereal-users] frame[xx] style filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bbice@xxxxxxxxxxxxxxx (Brent Bice)
Date: Fri, 23 Feb 2001 12:13:01 -0800 (PST)
   I just downloaded the latest version of ethereal (well, version 0.8.15)
and compiled/installed it.  But it looks like some of the filters don't work
anymore.  For instance, one of my favorite filters was:
frame[54] == 50:41:53:53 || frame[54] == 55:53:45:52

   But this filter now causes the error 'Unable to parse filter string
"frame[54] == 50:41:53:53 || frame[54] == 55:53:45:52"

   This was a great way for me to show the boss why A) nobody is allowed to
have root privs on the POP3 server, and B) nobody is allowed to access the
POP3 server across the internet.  (grin)  Really made him a believer in
VPN and encryption...

   My first thought was "oh, the syntax musta changed" so I highlighted a
POP3 USER command packet and said to MatchSelected, and the syntax of the
filter string it produces looks identical and produces the same type of
error. 

   Any ideas?

Brent Bice
bbice@xxxxxxxxxxxxxxx