Wireshark · Ethereal-dev: [Ethereal-dev] Capture- vs. Displayfilters

[Joerg Mayer <jmayer@xxxxxxxxx>]

Just an idea I had when I should have gone to bed...
untested...
and does only one half of the job...

   Jörg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.

Index: tethereal.c
===================================================================
RCS file: /usr/local/cvsroot/ethereal/tethereal.c,v
retrieving revision 1.199
diff -u -p -r1.199 tethereal.c
--- tethereal.c	25 Sep 2003 00:08:58 -0000	1.199
+++ tethereal.c	8 Oct 2003 23:00:37 -0000
@@ -143,7 +143,7 @@ typedef struct _loop_data {
 
 static loop_data ld;
 
-static int capture(int);
+static int capture(int, gchar *);
 static void capture_pcap_cb(guchar *, const struct pcap_pkthdr *,
   const guchar *);
 static void report_counts(void);
@@ -1400,7 +1400,7 @@ main(int argc, char *argv[])
             free_interface_list(if_list);
         }
     }
-    capture(out_file_type);
+    capture(out_file_type, rfilter);
 
     if (capture_opts.ringbuffer_on) {
       ringbuf_free();
@@ -1425,7 +1425,7 @@ main(int argc, char *argv[])
 static condition  *volatile cnd_ring_timeout = NULL; /* this must be visible in wtap_dispatch_cb_write */
 
 static int
-capture(int out_file_type)
+capture(int out_file_type, gchar * rfilter)
 {
   int         pcap_encap;
   int         file_snaplen;
@@ -1452,6 +1452,8 @@ capture(int out_file_type)
   struct pcap_stat stats;
   gboolean    write_err;
   gboolean    dump_ok;
+  dfilter_t   *rfcode = NULL;
+
 
   /* Initialize all data structures used for dissection. */
   init_dissection();
@@ -1543,8 +1545,11 @@ capture(int out_file_type)
       netmask = 0;
     }
     if (pcap_compile(ld.pch, &fcode, cfile.cfilter, 1, netmask) < 0) {
-      snprintf(errmsg, sizeof errmsg, "Unable to parse filter string (%s).",
+      fprintf(stderr, "tethereal: Unable to parse capture filter string (%s).",
 	pcap_geterr(ld.pch));
+      if (dfilter_compile(rfilter, &rfcode)) {
+        fprintf(stderr, "Interestingly enough, this looks like a valid display filter\n  Are you sure you didn't mix them up?\n");
+      }
       goto error;
     }
     if (pcap_setfilter(ld.pch, &fcode) < 0) {