tcpdump mailing list archives

filtering port ranges

From: Ed Sawicki <ed () alcpress com>
Date: Tue, 24 Aug 2004 00:57:45 -0700

I'm running the latest versions of tcpdump and pcap. I can't
filter on tcp port ranges.

These don't work - no packets are captured:

tcpdump -i eth1 tcp[0:2] > 1023 and tcp[0:2] < 60000
tcpdump -i eth1 'tcp[0:2] > 1023 and tcp[0:2] < 60000'
tcpdump -i eth1 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000'
tcpdump -i eth1 'tcp[0:2]>1023' and 'tcp[0:2]<60000'
tcpdump -i eth1 \( 'tcp[0:2] > 1023' and 'tcp[0:2] < 60000' \)

Is there a way to make this work?

Ed
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.

Current thread:

filtering port ranges Ed Sawicki (Aug 24)
- number of concurrent TCP sessions César Cárdenas (Aug 24)
  - Re: number of concurrent TCP sessions César Cárdenas (Aug 24)
  - Re: number of concurrent TCP sessions Kiss Karoly (Aug 24)
    - Re: number of concurrent TCP sessions César Cárdenas (Aug 24)
    - Concurrent TCP Connections César Cárdenas (Aug 25)
    - Re: Concurrent TCP Connections ronnie sahlberg (Aug 25)
    - Re: number of concurrent TCP sessions Stephen Donnelly (Aug 25)
    - Estimating whole parameters in a switched net César Cárdenas (Aug 29)
- Re: filtering port ranges alex medvedev (Aug 24)
  - Re: filtering port ranges Ed Sawicki (Aug 24)