[Winpcap-users] Port range filter

Guy Harris guy at alum.mit.edu
Fri Sep 30 21:53:11 GMT 2005


cycl0ne dude wrote:

> The "tcp[2:2] >= 6660 and tcp[2:2] <= 6690" doesnt work to me.

If you're using WinPcap releases prior to the final 3.1 release (or 
pre-0.9[.x] libpcap releases), there might be a bug in the optimizer 
that causes incorrect code to be generated for those expressions (I 
forget whether that bug has always been there or, if not, in what 
release it was introduced).  You'd have to turn the optimizer off.

If you're using the final WinPcap 3.1 release (or libpcap 0.9[.x]), the 
bug is fixed...

...but, in the final WinPcap 3.1 release (or libpcap 0.9[.x]), you can 
also just use "tcp portrange 6660-6690".


More information about the Winpcap-users mailing list