Ethereal-users: Re: [Ethereal-users] pcap filter syntax for ESP...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 25 Sep 2001 13:13:22 -0700 (PDT)
> How would i write a pcap filter to grab only ESP packets ?

If the libpcap that Ethereal is using is libpcap 0.5 or later (current
versions of WinPcap are based on libpcap 0.5), you write that filter as

	esp

If the libpcap that Ethereal is using is an earlier version, you write

	ip proto 50