|
Aharon,
The short answer is that you need to put quotes around
your filter
-f "ether proto
0xff00"
The reason why you didn't see the error message was
because you used the -Q option. -Q killed ethereal immediately after the error
was displayed. (Guy/Gerald etc Is this a bug or a
feature?)
If you
really want the command line options you're choosing, perhaps you would
be better off using "tethereal"
rather than ethereal? You get to see your error message and you wont need to
worry about -Q and -k. Unless you machine has multiple NICs you probably don't
need the -i option either. Just tell Ethereal which NIC to use by default in
Edit->Preferences->Capture select your normal NIC for tracing then click
some combination of Apply/Save/Close in order to get this to
work.
HTH
Alistair
Hi,
I am using the ethereal software
and I need help with working from command line.
I runt the following
command: ethereal\ethereal -c 1000 -i
\Device\Packet_{7AC24860-39CA-4439-A2E0-6261FE644D93} -k -w test
-Q
and it worked ok, I tried to add a
filter to the command: -f ether proto 0xff00, the ethereal application was
opened and closed
immediately without capturing and
saving file.
Registered Office:
Marks & Spencer p.l.c
Michael House, Baker Street,
London, W1U 8EP
Registered No. 214436 in England and Wales.
Telephone (020) 7935 4422
Facsimile (020) 7487 2670
www.marksandspencer.com
Please note that electronic mail may be monitored.
This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.
The registered office of Marks and Spencer Financial Services PLC, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB.
|