Hello Steve, > When I use this pcap compile string, my gcc compiler builds the executable, > but the pcap compile fails at run time: > > "\\(tcp or udp\\) and \\(src host 172.19.18.2 or src host 172.19.18.3\\)" > > The string above works well from the Linux command shell.
That is because you have to use escaping for the ( and ). When you use the same string in your application, you do not have to escape the ( and ). That's why pcap complains about the \ being there. (tcp or udp) and (src host 172.19.18.2 or src host 172.19.18.3) should work as expected. Sincerely, Erwin- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
