[<rluk@xxxxxxxxxxxxx>]

Hi Guy,

Thanks for your quick response.

No.  No VLAN.  192.168.1.0/24 is a small network.  And we are using a
hub.

I am using WinPCap 3.0 on my Win2k-Pro.

Roger

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxx] 
Sent: Friday, 30 May 2003 10:55 AM
To: Roger Luk
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Ethereal capture filter doesn't work


On Thu, May 29, 2003 at 07:36:40PM -0700, rluk@xxxxxxxxxxxxx wrote:
> But I hit a problem in capture filter:
> (1) I click "Capture --> Start" and enter a capture filter "host 
> 192.168.1.3".
> (2) My ethereal is on 192.168.1.2.
> (3) 192.168.1.3 is pinging 192.168.1.1 continuously.
> (4) All 3 machines are on a hub, not switch
> 
> But I cannot see any packets captured.  Why?

Are you using VLANs?  Are the packets from a VLAN?

If so, try

	vlan and host 192.168.1.3

and see if that works.  If so, the problem is that libpcap/WinPcap's
packet-filter-compiling code assumes, by default, that VLANs aren't
being used, and expects the IP header to come right after the Ethernet
header in a packet; you have to add "vlan and" to get it to expect the
IP header to come after a VLAN header.