Re: filtering port ranges

[alex medvedev <alexm () pycckue org>]

Hi Ed,

this is strange, because at least:

# tcpdump tcp[0:2] \> 1 and tcp[0:2] \< 79
# tcpdump 'tcp[0:2] > 1 and tcp[0:2] < 79'

both correctly work for me on

# tcpdump -V
tcpdump version 3.6
libpcap version 0.6

and

# ./tcpdump -V
tcpdump version 3.8
libpcap version 0.7.2

could it be your shell?

-alexm
20:51 24/08/2004



On Tue, 24 Aug 2004, Ed Sawicki wrote:

> I'm running the latest versions of tcpdump and pcap. I can't
> filter on tcp port ranges.
>
> These don't work - no packets are captured:
>
> tcpdump -i eth1 tcp[0:2] > 1023 and tcp[0:2] < 60000
> tcpdump -i eth1 'tcp[0:2] > 1023 and tcp[0:2] < 60000'
> tcpdump -i eth1 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000'
> tcpdump -i eth1 'tcp[0:2]>1023' and 'tcp[0:2]<60000'
> tcpdump -i eth1 \( 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000' \)
>
> Is there a way to make this work?
>
> Ed
> -
> This is the tcpdump-workers list.
> Visit https://lists.sandelman.ca/ to unsubscribe.



-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.