[Winpcap-users] More about filtering expression syntax

[Ziara .]

Oh! you're right. I've not noticed it. 
 
Thanks.> From: guy at alum.mit.edu> To: winpcap-users at winpcap.org> Subject: Re: [Winpcap-users] More about filtering expression syntax> Date: Wed, 5 Nov 2008 17:30:56 -0800> > > On Nov 5, 2008, at 1:59 AM, Ziara . wrote:> > > but I've tried with = "src host zzz.zzz.zzz.zzz and src host > > yyy.yyy.yyy.yyy" and is a invalid expression.> > To be precise, the error is "expression rejects all packets", i.e. > that expression cannot ever match any packet, as it checks whether the > IPv4 source address of the packet is zzz.zzz.zzz.zzz *and* is, at the > same time, yyy.yyy.yyy.yyy, which is impossible if zzz.zzz.zzz.zzz and > yyy.yyy.yyy.yyy aren't the same.> > A libpcap/WinPcap filter expression "A and B" matches the packet only > if A and B are simultaneously true.> > > Are there some way to filter multiple source ip or destination ip or > > both?> > The magic word here is "or", i.e.> > src host zzz.zzz.zzz.zzz or src host yyy.yyy.yyy.yyy> > matches any packet where the IPv4 source address is zzz.zzz.zzz.zzz > *or* is yyy.yyy.yyy.yyy.> _______________________________________________> Winpcap-users mailing list> Winpcap-users at winpcap.org> https://www.winpcap.org/mailman/listinfo/winpcap-users
_________________________________________________________________
 Ahora con Internet Explorer 7, llévate gratis un guiño personalizado
http://www.vivelive.com/ieak7/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20081106/b5b521f3/attachment.htm