Wireshark-users: [Wireshark-users] How to use specific protocol filters in pcap programming

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Javier Gálvez Guerrero <javier.galvez.guerrero@xxxxxxxxx>
Date: Mon, 27 Apr 2009 16:29:45 +0200
Hi there,

I'm trying to catch DHCP and IEEE 802.11 association packets in a
custom C program using libpcap but I'm facing some problems when
applying filter chains different than simple ones like 'ether dst X'
or 'port Y'. I would like to know what should I do in order to
properly get packets with libpcap that Wireshark show me when issuing
filter chains like:

bootp.option.value == 03
wlan.fc.type_subtype == 0x04

If I use a filter like the previous ones I get a filter compiling
error in 'pcap_compile(descr, &fp, filter, 0, netp)'.

Any idea about how could I do it? Any help would be much appreciated.


Thanks a lot,
Javi