On Wed, 21 Dec 2005 candidcalm@xxxxxxxxx wrote:
> Can someone please tell me how to use the capture filter
> gateway host
>
> or some example using the primitive "gateway".
>
> I know an alternative would be something like "ether host 11:22:33:44:55:66
> and not host 192.168.77.2", but would like to know how to make it working
> with the keyword gateway.
>
> (I am using ethereal on a windows machine.)
>From the WinPcap site:
------8<-------
gateway host
True if the packet used host as a gateway. I.e., the ethernet source
or destination address was host but neither the IP source nor the IP
destination was host. Host must be a name and must be found both by the
machine's host-name-to-IP-address resolution mechanisms (host name file,
DNS, NIS, etc.) and by the machine's host-name-to-Ethernet-address
resolution mechanism (/etc/ethers, etc.). (An equivalent expression is
ether host ehost and not host host
which can be used with either names or numbers for host / ehost.) This
syntax does not work in IPv6-enabled configuration at this moment.
------8<-------
I think the devil is in the fact that 'host' in 'gateway host' needs to be
a name.
Good luck,
Jaap