Re: how pcap filter string works?

[Guy Harris <guy () alum mit edu>]

On Jul 22, 2004, at 12:25 PM, Hu Thomas Pan wrote:

> I have a pcap filter string: udp and \( \( host host1 and port port1 
> \) or
> \( host host2 and port port2 \) \)
>
> Things are working through command line for tcpdump. But, it doesn't 
> work
> for pcap lib in the code.

Try using the string

	"udp and ( ( host host1 and port port1 ) or ( host host2 and port 
port2 ) )"

as the string you pass to "pcap_compile()".  The "\" before "(" and ")" 
in the tcpdump command line are to cause the shell not to treat them as 
special characters.  They're removed by the shell when those arguments 
are passed to tcpdump.

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.