[Paul Aitken <paitken@xxxxxxxxx>]

Guy Harris wrote:
> 
> On Wed, Jun 20, 2001 at 10:39:50AM +0100, Paul Aitken wrote:
> > > What are some of the filter expressions you've tried?
> >
> > !stp
> > !cdp
> > !stp && !cdp
> 
> Many versions of libpcap don't support "stp" as a filter expression, and
> even the latest tcpdump.org version of libpcap doesn't support "cdp".

Thanks for the explanation; I didn't realise capture and display filters
were handled differently. Having capture filters in the kernel is a fine
thing, and I understand why they have limited functionality.

> The only way for there *not* to be a difference between what's
> acceptable as a display filter and what's acceptable as a capture filter
> would be to limit display filters to what a capture filter can do - and
> that's far too restrictive.

Absolutely. I had thought you implimented both in Ethereal.

> > BTW, when I click "OK" or "Apply" on the "Ethereal: Display Filter"
> > dialog, a small squarish window with a STOP button appears and then
> > disappears extremely quickly?
> 
> If you don't want it to disappear quickly, only use *really large
> capture files*.

	;-)

I'm usually capturing a very short sequence of events!

Thanks.
-- 
Paul Aitken
IPv6 Development, Cisco Systems Ltd, Edinburgh, Scotland. EH6 6LX
T: +44 131 561 3616    F: +44 131 561 3601    M: +44 772 059 8073