Re: WISH: support for port ranges in filter syntax

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Sheldon Hearn, sie wrote:
> Hi folks,
>
> Has anyone done any work on supporting port ranges in filter syntax,
> e.g.
>
>       tcpdump -i bla0 -n tcp portrange 6000-6010

Actually, this only requires work on the parser of BPF.  You can't even
use some of the generic operations, that you can with other means.

The above can currently be done like this:

tcpdump \( 'tcp[0:2] >= 6000' and 'tcp[0:2] <= 6010' \) or \
        \( 'tcp[2:2] >= 6000' and 'tcp[2:2] <= 6010' \)

Darren
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe