Ethereal-users: Re: [Ethereal-users] capture filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Phil Reinemann <Phil.Reinemann@xxxxxxxx>
Date: Mon, 16 Feb 2004 21:04:22 -0600
This may have been stated elsewhere in an archive (but I found it difficult 
to look through the archives with no search), so in answer to Kris Pratt's 
problem with getting a capture filter to work in Win32, the Ethereal 
documentation doesn't match reality. Tcpdump doesn't help either. The 
documentation says to use periods for the delimiters.
I found that on WIN32 (W98SE) that to get a capture filter to work for a 
MAC one must use the following:
"ether host tt:uu:ww:xx:yy:zz" minus the quotation marks. In other words, 
use colons, even though Ethereal documentation shows MACs with periods. 
"ether" and "host" also both seem to be necessary.
If you don't do this, you get a parsing error for the filter.
Kris Pratt, asked this question on Jan 16, 2004 at 11:13 AM (in what time 
zone I don't know).

	Phil Reinemann