Ethereal-users: Re: [Ethereal-users] RE: Packet capture doesn't work?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 8 Mar 2002 12:58:55 -0800
On Fri, Mar 08, 2002 at 12:03:20PM -0800, beby@xxxxxxxxxxxx wrote:
> This happens because Ethereal (or something under it) seems to get its
> capture string messed up after each return of "Unable to parse filter string
> (parse error)."  Once you've put in one bad capture filter, you have to
> restart Ethereal to get things straitened out.

It's something under it.  There was a bug in libpcap that caused it not
to discard the rest of an expression if it got a parse error; the next
time it tried to parse an expression, it might see part of the rest of
the previous expression before seeing the new expression.

WinPcap 2.2 is based on a version of libpcap (0.5) with that bug.  The
WinPcap 2.3 beta is based on a version of libpcap (0.6.2) without that
bug; WinPcap 2.3 may be officially released soon.