[Winpcap-users] Filter Problem
mqx at low-axs.net
Sat Nov 26 22:09:27 GMT 2005
Guy Harris wrote:
> Deston High wrote:
>> Hello, i have problem's filter outgoing traffic.
>> When i set a filter (eg. "tcp and port 60000") then pcap_dispatch
>> doesn't get
>> any packet. (there are packets with port 60000 (both sport and dport)!)
>> ...i send a packet with source and destination port 60000 and have the
>> PPPOE protocol set. (just want to mention this)
> If you're capturing on an Ethernet, a filter such as "tcp and port
> 60000" will match packets running as TCP-over-IP-over-Ethernet to or
> from port 60000, but will *NOT* match packets running as
hmm... thats a problem. the program i write shouldn't run only on pc's
which are use PPPOE. :(
Atm, i have a workaround, where two threads send and capture
synchronous. (whithout using filter)
But it's really a bad workaround!
>> I have tryed the filter "src host 192.168.0.1" (assuming 192.168.0.1
>> is my ip)
>> and the capturing works, but when i try to touch the TCP header it
>> always fails.
> So are the packets going to or from 192.168.0.1 running on Ethernet,
> or on PPPOE?
Oh, i see 192.168.0.1 was indeed a bad example.. in the program it isn't
a LAN IP, it's the internet IP.
So lets say it's 126.96.36.199 and its is also the source IP. so it's
FROM. ("src host 188.8.131.52") ;-)
And, YES, i capture on ethernet.
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
More information about the Winpcap-users