Re: Multiple pcap filters on interface

[Guy Harris <guy () alum mit edu>]

On Oct 7, 2008, at 1:07 PM, Jim Mellander wrote:

> All of the above are attempts to overcome the 'one filter per  
> interface
> per process' model that I believe libpcap imposes

So why does it need overcoming?  A filter says "only deliver me  
packets that match the following"; would multiple packets mean  
"deliver me packets that match any of the following", in which case  
that reduces to one filter (a || b || c ...), or "deliver me packets  
that match all of the following", in which case that reduces to one  
filter (a && b && c ...), or something else?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.