[Senthil Kumar <psk@xxxxxxxxxx>]

Yes! i was trying with a wrong setting!
But i found a way to decode the ppp protocols without setting the filter. In
the preferences i selected the ppp protocol and in the filter used "host
<ip-addr of the destination>".

Thanks for your comments!

Guy Harris wrote:

> On Tue, Mar 05, 2002 at 12:25:33PM -0600, Senthil Kumar wrote:
> > I am getting the warning screen:
> >
> > Unable to parse filter string(parse error) when i start to capture with
> > the filter string
> > ether proto ppp
> >
> > I checked with the tcpdump & the syntax look ok.
>
> You didn't check carefully enough.
>
> The tcpdump 3.7.1 man page says:
>
>           ether proto protocol
>                True if the packet  is  of  ether  type  protocol.
>                Protocol  can  be a number or one of the names ip,
>                ip6, arp, rarp, atalk,  aarp,  decnet,  sca,  lat,
>                mopdl,  moprc,  iso,  stp,  ipx, or netbeui.  Note
>                these identifiers are also keywords  and  must  be
>                escaped via backslash (\).
>
> It says nothing about "ppp", so the syntax of "ether proto ppp" isn't OK
> (or the syntax is OK but the semantics aren't OK, but, in either case,
> it's not a valid expression).
>
> If by "ether proto ppp" you mean you want to filter for PPPoE, then you
> have to use numbers:
>
>         ether proto 0x8863 or ether proto 0x8864