Wireshark · Ethereal-users: Re: [ethereal-users] Is File/Reload needed any more?

[Warren Young <tangent@xxxxxxxx>]

Guy Harris wrote:
> 
> If you used a read filter, you *have* learned the display filter
> language, because read filters use the display filter language, not the
> "tcpdump" capture filter language.

Hmmm....I was sure I was doing this from the command line, so I guess I
was using the display filter language without realizing it.  Are they
really that close to each other?  E.g., does "host foo and [host] bar"
work for both display and capture filtering?  (Not sure about the second
"host".)
 
> Note that when we use a compatible filter language for captures and
> other purposes (display filters, read filters, and coloring filters all
> use the same syntax), it'll probably be the *display* filter language,

That's perfectly fine.  About the only time I use tcpdump any more is
when I'm telnetted into a remote machine and need to do a packet capture
on that machine's LAN.  (I capture to a dump file and then use Ethereal
locally to analyze it.)  

In other words, I don't much care about learning another language, just
so long as Ethereal is consistent, since I'll use it most often.  If
that means that I start forgetting elements of the tcpdump capture
language, so be it.  I have the man pages.  ;->
-- 
= Warren Young: www.cyberport.com/~tangent |   Yesterday it worked.
= ICBM Address: 36.8274040N, 108.0204086W, | Today it is not working.
=               alt. 1714m                 |   Windows is like that.