<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri","sans-serif";
color:windowtext}
.MsoChpDefault
{font-family:"Calibri","sans-serif"}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
</style><style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" lang="EN-US" link="blue" vlink="purple">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Are you sure you're looking at the correct output file?<br>
What you're describing works for me:<br>
<br>
I did this:<br>
windump -s 0 -C100 -w test -W 40 -i 2 host !192.168.1.1<br>
<br>
And did a ping and a web port request to it while running...<br>
<br>
Then I do this...note that the filename is test00<br>
windump -r test00 host 192.168.1.1<br>
reading from file test00, link-type EN10MB (Ethernet)<br>
<br>
And no packets are shown.<br>
<br>
<br>
<div><br>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<p>Michael D. Black<br>
Senior Scientist<br>
Analytics, Production and Services<br>
Advanced GEOINT Systems<br>
Northrop Grumman Information Systems<br>
</p>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF254245"><font color="#000000" face="Tahoma" size="2"><b>From:</b> winpcap-users-bounces@winpcap.org [winpcap-users-bounces@winpcap.org] on behalf of Jerry Riedel [riedel@codylabs.com]<br>
<b>Sent:</b> Thursday, May 01, 2014 3:44 PM<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> EXT :[Winpcap-users] strange filtering issue<br>
</font><br>
</div>
<div></div>
<div>
<div class="WordSection1">
<p class="MsoNormal">Hello,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I am trying to use filters in conjunction with saving the filtered packets to a file, using windump, but when I do, the filters seem to get ignored. Here is an example of what I am trying:
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">c:\windump -i 1 -s 0 -C 100 -w test -W 40 !host 192.168.10.2</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">When I use this, there are still packets to/from that host in the capture file. On the other hand, if I use:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">windump -i 1 !host 192.168.10.2 </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">…on the command line, I can see the packets to/from that host filtered out. To be clear, if I remove the ! from the command line, I see traffic to/from that host, if I add the ! back in, I don’t, and there is a constant stream of traffic
to/from this host.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">The documentation I have been able to find seems to indicate that this is legal and I don’t get any syntax errors. What am I missing?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:10.0pt; font-family:"Arial","sans-serif"">Jerry
</span></p>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</div>
</body>
</html>