Re: Bug in Pcap Compile?

[Erwin van Eijk <erwin () leastwanted nl>]

Hello Steve,

> When  I use this pcap compile string, my gcc compiler builds the executable, but the pcap compile fails at run time:
>
> "\\(tcp or udp\\) and \\(src host 172.19.18.2 or src host 172.19.18.3\\)"
>
> The string above works well from the Linux command shell.

That is because you have to use escaping for the ( and ). When you use the same string in your application, you do not 
have to escape the ( and ). That's why pcap complains about the \ being there.

(tcp or udp) and (src host 172.19.18.2 or src host 172.19.18.3)

should work as expected.

Sincerely,
Erwin-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.