Wireshark · Ethereal-users: Re: [Ethereal-users] tethereal filters on one adapter, not on another

[Guy Harris <gharris@xxxxxxxxx>]

Paul Wozney wrote:

> Oddly enough, the following does *not* work:
>
> root@nmsdev:/home/paul# tethereal -i eth0 -f "net 10.1.1"
> Warning:  Couldn't obtain netmask info (eth0: no IPv4 address assigned).
> Capturing on eth0
> 0 packets captured

At least if the capture you sent me is an example, the problem is that 
the 10.1.1 net traffic is on a VLAN.  libpcap filters don't check both 
for regular and VLAN traffic; you have to do that explicitly, e.g.

	vlan and net 10.1.1

to capture only VLAN traffic for that network or

	net 10.1.1 or (vlan and net 10.1.1)

to capture net 10.1.1 traffic regardless of whether it's on a VLAN or 
not.  (As the second expression might imply, the libpcap filter has to 
check both separately; perhaps whoever added the "vlan" keyword didn't 
want to burden *all* captures that check for stuff past the link-layer 
header with doing two checks.)

Display/read filters aren't implemented in as low-level a fashion as are 
libpcap filters, so they can find the IP address no matter what the 
offset is.