[Gilbert Ramirez <gilramir@xxxxxxxxx>]

charles@xxxxxxxxxxxxxx wrote:
> 
> i am trying to use the new filter creation tool to simply display traffic
> to/from a single host.
> 
> i select edit->filters
> 
> i type in the filter name: TESTBOX
> 
> and in filter string, i click on Add Expression...
> 
> i select IP->source or destination->192.168.100.45
> 
> i hit New, then click save and ok.
> 
> i go to start a capture and select this filter, i then get an error
> saying:
> 
>         Unable to parse filter string (parse error)

You created a *display* filter. It cannot be used for *capturing*.
The man page talks a bit about the difference. Display filters
use Ethereal's own syntax, while capture filters use the tcpdump/libpcap
syntax.

In the next release of Ethereal, the GUI will separate the
Display filters from the capture filters, to help avoid this confusion.
Edit|Filters will no longer exist. Edit|Display filters and
Edit|Capture filters will take its place.

--gilbert