Ethereal-users: Re: [ethereal-users] Filtering packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gerald Combs <gerald@xxxxxxxx>
Date: Wed, 5 Jan 2000 09:16:45 -0600 (EST)
On Wed, 5 Jan 2000, Guy Harris wrote:

> > When I then fill in something in the filter field the capture works. 
> 
> Thank you.

Yes!  Thank you!

> Sigh....
> 
> We could work around it by compiling the filter string even if it's
> blank, and installing that; this adds some instructions to the code
> path, and, besides, it's just Ugly, but at least it'll let you capture
> packets on RH 6.1.

The following hack applied to gtk/capture_dlg.c appears to make things
work:

--- capture_dlg.c       Wed Jan  5 08:50:13 2000
+++ capture_dlg.c.orig  Wed Jan  5 08:50:52 2000
@@ -348,8 +348,6 @@
   cf.cfilter = NULL; /* ead 06/16/99 */
   if (filter_text && filter_text[0]) {
     cf.cfilter = g_strdup(filter_text);
-  } else {
-    cf.cfilter = g_strdup("");
   }

   save_file = gtk_entry_get_text(GTK_ENTRY(file_te));

It looks like a similar change needs to be made to gtk/main.c for the '-k'
flag to work when no command-line filter is supplied.  I'll check the
changes in later today.

> (Every day, I grow more eager to teach wiretap to do packet capture,
> blow the explosive bolts, and cast libpcap loose to drift into the far
> reaches of space....)

I would be willing to FedEx a box of my wife's cookies to anyone who
manages to do this.  :-)