[Winpcap-users] Filter Problem

[Guy Harris]

Deston High wrote:
> Hello, i have problem's filter outgoing traffic.
> When i set a filter (eg. "tcp and port 60000") then pcap_dispatch 
> doesn't get
> any packet. (there are packets with port 60000 (both sport and dport)!)
> ...i send a packet with source and destination port 60000 and have the
> PPPOE protocol set. (just want to mention this)

If you're capturing on an Ethernet, a filter such as "tcp and port 
60000" will match packets running as TCP-over-IP-over-Ethernet to or 
from port 60000, but will *NOT* match packets running as 
TCP-over-IP-over-PPP-over-Ethernet.

> I have tryed the filter "src host 192.168.0.1" (assuming 192.168.0.1 is 
> my ip)
> and the capturing works, but when i try to touch the TCP header it 
> always fails.

So are the packets going to or from 192.168.0.1 running on Ethernet, or 
on PPPOE?