Ethereal-users: Re: [Ethereal-users] Display Filter and Capture Filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jeff Heath <jheath1@xxxxxxxxxxxxx>
Date: Mon, 07 Mar 2005 10:04:05 -0500
On Mon, 2005-03-07 at 02:47, Eric Lam, Fu Wa wrote:
> Dear all,
> 
>  
> 
> I am new to Ethereal (0.10.7). I set up a display filter
> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510). Would anyone
> teach me how to setup the capture filter so that only the traffic with
> (mgcp.rsp.rspcode >= 500 and mgcp.rsp.rspcode <= 530 and
> mgcp.rsp.rspcode != 501 and mgcp.rsp.rspcode != 510) will be captured.
> Many thanks.
> 
snip

Eric,

In Ethereal the capture filters and the display filters operate quite
differently.   The capture filters are limited to what is possible with
tcpdump, which is quite a bit less than what is possible with the
display filters.  Unfortunately, what you are trying to do is not
possible with a capture filter.  For more information, download the
Ethereal manual and search on capture filters.

Jeff