[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 04:49 PM 11/16/2005, Guy Harris wrote:
> Jeff Davis wrote:
>
> > This is the error message:
> > "net" was unexpected in this context.
> > The following display filter isn't a valid display filter:
> > (dst net 187 or tcp dst net 197)
>
> tcpdump agrees with Ethereal:
>
>         $ tcpdump -d '(dst net 187 or tcp dst net 197)'
>         tcpdump: WARNING: en0: no IPv4 address assigned
>         tcpdump: 'tcp' modifier applied to host
>
> although it really means "'tcp' modifier applied to net" - TCP has neither 
> hosts nor nets, those are properties of IP.
>
> There's also *another* problem that I suspect is due to the filter being 
> long (the error message might be too long), so it might be that no syntax 
> error is displayed for your really long filter - but the long one gets the 
> same error from tcpdump as '(dst net 187 or tcp dst net 197)' gets.
>
> Try "dst net 0 or dst net 1 or..." instead.

But the error he got says "The following display filter isn't a valid 
display filter" - doesn't that mean he was trying to use capture filter 
syntax for a display filter?