Ethereal-users: Re: [Ethereal-users] DHCP filtering while capturing problem / possible bug?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 7 Aug 2003 11:06:38 -0700
On Thursday, August 7, 2003, at 5:13 AM, Aki.Sivula@xxxxxxxxxxxxxxx wrote: 


Filtering while capturing won't work as we expected.
We need to filter only DHCP traffic, but somehow that "filtering while
capturing" displays
only a BOOTP packets but ignores the DHCP messages.

Here is the list of all tested filters

port 67 and port 68
src port 67 and dst port 67 and src port 68 and dst port 68
udp port 67 and udp port 68
Are the DHCP messages that are being ignored sent to, or from, UDP (or TCP) port 67 or 68? 

If not, then those filters obviously will filter them out.
If so, then this is a libpcap/WinPcap bug, not an Ethereal bug - you'll see it in WinDump, too. Capture filtering is not done by code in Ethereal, it's done by code in libpcap/WinPcap, which Ethereal uses to do packet capturing.