> I would like to know if it is possible to filter with PCAP on a range of > ports by using "pcap_compile" function. > > I tried several filter expressions but each one was rejected by the > function : > > Examples of expressions I tried : > > "ip and (port >= 1000 and port <= 2000)" > "ip and (port 1000 >= port 2000)"
Not directly, as far as I know. But you can do things like "tcp[2:2] >= 1000 and tcp[2:2] <= 2000" to filter on TCP destination port within a specified range. Steinar Haug, Nethelp consulting, [EMAIL PROTECTED] - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
