On Thu, May 29, 2003 at 07:36:40PM -0700, [EMAIL PROTECTED] wrote:
> But I hit a problem in capture filter:
> (1) I click "Capture --> Start" and enter a capture filter "host
> 192.168.1.3".
> (2) My ethereal is on 192.168.1.2.
> (3) 192.168.1.3 is pinging 192.168.1.1 continuously.
> (4) All 3 machines are on a hub, not switch
>
> But I cannot see any packets captured. Why?
Are you using VLANs? Are the packets from a VLAN?
If so, try
vlan and host 192.168.1.3
and see if that works. If so, the problem is that libpcap/WinPcap's
packet-filter-compiling code assumes, by default, that VLANs aren't
being used, and expects the IP header to come right after the Ethernet
header in a packet; you have to add "vlan and" to get it to expect the
IP header to come after a VLAN header.
