[Winpcap-users] Port range filter
guy at alum.mit.edu
Fri Sep 30 21:53:11 GMT 2005
cycl0ne dude wrote:
> The "tcp[2:2] >= 6660 and tcp[2:2] <= 6690" doesnt work to me.
If you're using WinPcap releases prior to the final 3.1 release (or
pre-0.9[.x] libpcap releases), there might be a bug in the optimizer
that causes incorrect code to be generated for those expressions (I
forget whether that bug has always been there or, if not, in what
release it was introduced). You'd have to turn the optimizer off.
If you're using the final WinPcap 3.1 release (or libpcap 0.9[.x]), the
bug is fixed...
...but, in the final WinPcap 3.1 release (or libpcap 0.9[.x]), you can
also just use "tcp portrange 6660-6690".
More information about the Winpcap-users