Hi, That is a display filter syntax you're writing. Consult man tcpdump for capture file syntax. There you will find there's no real way to filter PPP LCP this way.
Thanx, Jaap [EMAIL PROTECTED] wrote: > Hello everyone! > I'd like to write a capture filter, to capture only PPP LCP packets, I > use ppp[0:2] = 0xc021, the first two bytes "0xc021" of PPP header means > Link Control Protocol(LCP), this capture filter should work, but it > captures nothing, why? > Any suggestion is welcome. > > Best Regards > cwflying > _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
