[Winpcap-users] Filter Problem

[Deston High]

Guy Harris wrote:

> Deston High wrote:
>
>> Hello, i have problem's filter outgoing traffic.
>> When i set a filter (eg. "tcp and port 60000") then pcap_dispatch 
>> doesn't get
>> any packet. (there are packets with port 60000 (both sport and dport)!)
>> ...i send a packet with source and destination port 60000 and have the
>> PPPOE protocol set. (just want to mention this)
>
>
> If you're capturing on an Ethernet, a filter such as "tcp and port 
> 60000" will match packets running as TCP-over-IP-over-Ethernet to or 
> from port 60000, but will *NOT* match packets running as 
> TCP-over-IP-over-PPP-over-Ethernet.

hmm... thats a problem. the program i write shouldn't run only on pc's 
which are use PPPOE. :(
Any workaround?
Atm, i have a workaround, where two threads send and capture 
synchronous. (whithout using filter)
But it's really a bad workaround!

>
>> I have tryed the filter "src host 192.168.0.1" (assuming 192.168.0.1 
>> is my ip)
>> and the capturing works, but when i try to touch the TCP header it 
>> always fails.
>
>
> So are the packets going to or from 192.168.0.1 running on Ethernet, 
> or on PPPOE?

Oh, i see 192.168.0.1 was indeed a bad example.. in the program it isn't 
a LAN IP, it's the internet IP.
So lets say it's 123.123.123.123 and its is also the source IP. so it's 
FROM. ("src host 123.123.123.123") ;-)
And, YES, i capture on ethernet.

> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>