Ethereal-users: Re: [Ethereal-users] Newbie question about capture filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 7 Aug 2001 01:20:21 -0700
On Tue, Aug 07, 2001 at 10:10:37AM +0200, hans.verbeek@xxxxxxxxxxx wrote:
> The syntax for that version is like you indicated:
> a) h225
> b) h225 || h245

That'd be the *display* filter syntax for it in the H.323-enhanced
version of Ethereal.

However, there is, as noted, no *capture* filter syntax for it (the
capture filter syntax is not defined by Ethereal, it's defined by
libpcap - and limited by the BPF engine that libpcap and many OS kernels
use, so there are limits on what Ethereal would be able to do in a
capture filter even if it had its own parser).