[Winpcap-users] Filter Problem

[Guy Harris]

Deston High wrote:

> hmm... thats a problem. the program i write shouldn't run only on pc's 
> which are use PPPOE. :(
> Any workaround?

1) Download the WinPcap source, update its BPF compiler to the version 
in the current top-of-CVS-tree version of libpcap (which is not in any 
libpcap release or WinPcap release), compile the new WinPcap and replace 
wpcap.dll with the one you built, and then use

	pppoes and tcp and port 60000

as the filter if you're interested only in traffic running over the 
PPPoE connection.

2) See if there's a PPP device on which you can capture, and try 
capturing on that rather than on the Ethernet on which that PPP device 
is running.

> Oh, i see 192.168.0.1 was indeed a bad example.. in the program it isn't 
> a LAN IP, it's the internet IP.
> So lets say it's 123.123.123.123 and its is also the source IP. so it's 
> FROM. ("src host 123.123.123.123") ;-)
> And, YES, i capture on ethernet.

"On Ethernet" doesn't indicate whether the traffic is 
IP-directly-over-Ethernet or IP-over-PPP-over-Ethernet.  Is the traffic 
you're capturing with the "src host" filter running on 
IP-directly-over-Ethernet or is it running on IP-over-PPP-over-Ethernet.