Ethereal-users: Re: [Ethereal-users] Ethereal capture filter doesn't work

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 29 May 2003 19:54:41 -0700
On Thu, May 29, 2003 at 07:36:40PM -0700, rluk@xxxxxxxxxxxxx wrote:
> But I hit a problem in capture filter:
> (1) I click "Capture --> Start" and enter a capture filter "host
> 192.168.1.3". 
> (2) My ethereal is on 192.168.1.2.
> (3) 192.168.1.3 is pinging 192.168.1.1 continuously.
> (4) All 3 machines are on a hub, not switch
> 
> But I cannot see any packets captured.  Why?

Are you using VLANs?  Are the packets from a VLAN?

If so, try

	vlan and host 192.168.1.3

and see if that works.  If so, the problem is that libpcap/WinPcap's
packet-filter-compiling code assumes, by default, that VLANs aren't
being used, and expects the IP header to come right after the Ethernet
header in a packet; you have to add "vlan and" to get it to expect the
IP header to come after a VLAN header.