[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 1, 2009, at 9:26 AM, Boaz Galil wrote:

> The problem is  when I want to use the same command for UDP e.g : “"  
> -f "host x.x.x.x  and  ((udp [2:2] >= 20 and udp [2:2] <= 80) or  
> (udp [0:2] >= 20 and  udp [0:2] <= 80))" I am not getting any error  
> but I am also not getting any results inside the packet capture file.

Are you getting any traffic to or from UDP ports 20 through 80 on your  
network?

(BTW, newer versions of libpcap support "host x.x.x.x and {tcp,udp}  
portrange 20-80".)