Ethereal-users: Re: [Ethereal-users] tethereal capture filter for multiple ports

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 21 Aug 2006 15:33:11 -0700
-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------


On Aug 21, 2006, at 10:13 AM, Tom wrote:

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx .
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Hi, I am looking for the tethereal capture filter
syntax for capturing multiple ports (2 to 5 ports).

Well, tethereal's not being developed any more (as per the above), but TShark is what it was renamed to, and the answer is the same for both.


With the following command, I am NOT able to capture
packets: (Note: it says it is capturing but it is
actually not capturing)

[root@root]# tethereal -f "(port 5060) and (port
8688)" -w test13.cap
Capturing on eth0

How do you know it's not capturing?

The fact that it doesn't print anything only proves it's not capturing if you have traffic on your network that's going between ports 5060 and 8688. If you have traffic going *to* port 5060 but not coming *from* port 5060 or port 8688, or coming *from* port 5060 but not going *to* port 5060 or port 8688, or going *to* port 8688 but not coming *from* port 5060 or port 8688, or coming *from* port 8688 but not going *to* port 5060 or port 8688, that filter will *not* capture it.

"And" means "and" in the sense of "the packet is going to or coming from port 5060 *and* the *SAME* packet is coming from or going to port 8688". "port X and port Y" doesn't mean "capture traffic to or from port X and also capture traffic to or from port Y", it means "capture a packet that is, at the same time, going to or coming from port X and coming from or going to port Y".

If you want to capture traffic to or from port X and also capture traffic to or from port Y, that's traffic that's coming from or going to port X *OR* coming from or going to port Y, so the filter for *that* would be

	port 5060 or port 8688

The following is a syntax error:

[root@root]# tethereal -f "(port 5060)" and "(port
8688)" -w test15.cap

The "-f" flag takes the next command-line token as the filter expression; all subsequent command-line tokens are *NOT* part of the filter. Thus, the argument to "-f" is "(port 5060)", and the "and" and "(port 8688)" are treated as extra arguments - and extra arguments to tshark (and tethereal) are glued together and treated as a capture filter, so that's "and (port 8688)", which isn't valid.

TShark needs to catch the case where you have "-f" *and* have extra arguments, and complain about that. (And tcpdump needs to print something more meaningful than "syntax error" in that case.)

In addition, the tshark *manual* needs to more clearly document that

	tshark port 5060 or port 8688

captures with "port 5060 or port 8688" as a capture filter.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users