<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Oh! you're right. I've not noticed it. <BR>
<BR>
Thanks.<BR><BR>> From: guy@alum.mit.edu<BR>> To: winpcap-users@winpcap.org<BR>> Subject: Re: [Winpcap-users] More about filtering expression syntax<BR>> Date: Wed, 5 Nov 2008 17:30:56 -0800<BR>> <BR>> <BR>> On Nov 5, 2008, at 1:59 AM, Ziara . wrote:<BR>> <BR>> > but I've tried with = "src host zzz.zzz.zzz.zzz and src host <BR>> > yyy.yyy.yyy.yyy" and is a invalid expression.<BR>> <BR>> To be precise, the error is "expression rejects all packets", i.e. <BR>> that expression cannot ever match any packet, as it checks whether the <BR>> IPv4 source address of the packet is zzz.zzz.zzz.zzz *and* is, at the <BR>> same time, yyy.yyy.yyy.yyy, which is impossible if zzz.zzz.zzz.zzz and <BR>> yyy.yyy.yyy.yyy aren't the same.<BR>> <BR>> A libpcap/WinPcap filter expression "A and B" matches the packet only <BR>> if A and B are simultaneously true.<BR>> <BR>> > Are there some way to filter multiple source ip or destination ip or <BR>> > both?<BR>> <BR>> The magic word here is "or", i.e.<BR>> <BR>> src host zzz.zzz.zzz.zzz or src host yyy.yyy.yyy.yyy<BR>> <BR>> matches any packet where the IPv4 source address is zzz.zzz.zzz.zzz <BR>> *or* is yyy.yyy.yyy.yyy.<BR>> _______________________________________________<BR>> Winpcap-users mailing list<BR>> Winpcap-users@winpcap.org<BR>> https://www.winpcap.org/mailman/listinfo/winpcap-users<BR><BR><br /><hr />Descubre durante 3 meses gratis la protección total de <a href='http://www.vivelive.com/onecare/' target='_new'>One Care</a></body>
</html>