[Winpcap-users] Port range filter

[Guy Harris]

cycl0ne dude wrote:

> The "tcp[2:2] >= 6660 and tcp[2:2] <= 6690" doesnt work to me.

If you're using WinPcap releases prior to the final 3.1 release (or 
pre-0.9[.x] libpcap releases), there might be a bug in the optimizer 
that causes incorrect code to be generated for those expressions (I 
forget whether that bug has always been there or, if not, in what 
release it was introduced).  You'd have to turn the optimizer off.

If you're using the final WinPcap 3.1 release (or libpcap 0.9[.x]), the 
bug is fixed...

...but, in the final WinPcap 3.1 release (or libpcap 0.9[.x]), you can 
also just use "tcp portrange 6660-6690".