On Feb 8, 2007, at 1:17 PM, Gianluca Varenni wrote: > Please use some parentheses like this > > (tcp and ip src host 192.168.1.1) || (tcp and ip dst host 192.168.1.1) Or just say tcp and ip host 192.168.1.1 (and also use the "-p" flag, to turn promiscuous mode off, if you're running on the other host).