Ethereal-dev: Re: [ethereal-dev] Syntax for capture filter (Truth in advertising?)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Mon, 19 Jun 2000 20:50:50 -0700
On Mon, Jun 19, 2000 at 06:09:57PM +0100, Ben Fowler wrote:
> The operative cause of the problem was that I had
>        tcp port 80 OR tcp port 3128
> in the filters dialogue, and this was sufficient to
> prevent the filter working, without unfortunately alerting
> me to the problem

When I tried it, I got a dialog box that said

	Unable to parse filter string (parse error)

Unfortunately, libpcap's parser doesn't do anything to try to give a
more precise diagnostic than "parse error", so it can't tell you that
the problem is that "OR" isn't a valid token, but it does, at least, let
you know that it's not valid.

> Since compatibility with tcpdump is a useful feature and starting
> point, I am not suggesting that case sensitivity be changed;

So are you saying that tcpdump *did*, or *didn't*, accept

	tcp port 80 OR tcp port 3128

with upper-case "OR"?